Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502958
MD5:	3a8e001d779a4b8d093e96295c4af868
SHA1:	707ddb1927149d7e8cac6bd4c480fa638d003e7a
SHA256:	217a7dc3e97859a1940310cca2dc0018e6c553679447afc49b96e7c0a392a4c5
Tags:	exe
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3A8E001D779A4B8D093E96295C4AF868)

msedge.exe (PID: 7508 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7760 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2104,i,16367940205438321316,3256968746704299152,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7768 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8064 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8864 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5804 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8876 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4924 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8952 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7260 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8976 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7260 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 8624 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8844 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9112 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4208 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9516 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9528 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9924 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 10148 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2108,i,15634359973341199469,6712066980228032313,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8244 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8308 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1772 --field-trial-handle=2096,i,11366431695399386351,13739223435221884792,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8592 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9744 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2072,i,15283468043023513582,12417513997533884230,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.2938215005.00000000018FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.12.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.12.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.12.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 7934cda1-aed6-4925-9668-4a6f6f9d63d3.tmp.13.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.12.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 7934cda1-aed6-4925-9668-4a6f6f9d63d3.tmp.13.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.12.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.12.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: content.js.12.dr, content_new.js.12.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 7934cda1-aed6-4925-9668-4a6f6f9d63d3.tmp.13.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.12.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49798 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B3EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00B3EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B3ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00B3ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_00B3EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B2AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00B2AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B59576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00B59576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1673528390.0000000000B82000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f4d57590-a
Source: file.exe, 00000000.00000000.1673528390.0000000000B82000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_ea952f26-7
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_350eb6f8-7
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_770fbc0c-5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B2D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00B2D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B21201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00B21201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B2E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00B2E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC8060	0_2_00AC8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B32046	0_2_00B32046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B28298	0_2_00B28298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFE4FF	0_2_00AFE4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF676B	0_2_00AF676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B54873	0_2_00B54873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AECAA0	0_2_00AECAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACCAF0	0_2_00ACCAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADCC39	0_2_00ADCC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF6DD9	0_2_00AF6DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC91C0	0_2_00AC91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADB119	0_2_00ADB119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE1394	0_2_00AE1394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE1706	0_2_00AE1706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE781B	0_2_00AE781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE19B0	0_2_00AE19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC7920	0_2_00AC7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD997D	0_2_00AD997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE7A4A	0_2_00AE7A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE7CA7	0_2_00AE7CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE1C77	0_2_00AE1C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF9EEE	0_2_00AF9EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B4BE44	0_2_00B4BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE1F32	0_2_00AE1F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00AE0A30 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00ADF9F2 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.evad.winEXE@94/517@20/13

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B337B5 GetLastError,FormatMessageW,

0_2_00B337B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B210BF AdjustTokenPrivileges,CloseHandle,		0_2_00B210BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B216C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00B216C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B351CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00B351CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B4A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00B4A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B3648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00B3648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AC42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00AC42A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\22aa41b9-e967-4af6-81fe-7c268f27ab21.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.12.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2104,i,16367940205438321316,3256968746704299152,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5804 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4924 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7260 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7260 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4208 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2108,i,15634359973341199469,6712066980228032313,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1772 --field-trial-handle=2096,i,11366431695399386351,13739223435221884792,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2072,i,15283468043023513582,12417513997533884230,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2104,i,16367940205438321316,3256968746704299152,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5804 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4924 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7260 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7260 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4208 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2108,i,15634359973341199469,6712066980228032313,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1772 --field-trial-handle=2096,i,11366431695399386351,13739223435221884792,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2072,i,15283468043023513582,12417513997533884230,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AC42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AC42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AE0A76 push ecx; ret

0_2_00AE0A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00ADF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B51C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00B51C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-95793

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6470

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 4.0 %

Source: C:\Users\user\Desktop\file.exe TID: 7496

Thread sleep time: -64700s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6470 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B2DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B368EE FindFirstFileW,FindClose,	0_2_00B368EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00B3698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B2D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B2D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B2D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B39642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B39642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B3979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B3979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B39B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00B39B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B35C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00B35C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AC42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AC42DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-95888

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B3EAA2 BlockInput,

0_2_00B3EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AF2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00AF2622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AC42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AC42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AE4CE8 mov eax, dword ptr fs:[00000030h]

0_2_00AE4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B20B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00B20B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AF2622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00AE083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE09D5 SetUnhandledExceptionFilter,	0_2_00AE09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00AE0C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00B21201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B02BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00B02BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ADF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00ADF98E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B422DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00B422DA

Source: C:\Users\user\Desktop\file.exe

0_2_00B20B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B21663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00B21663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AE0698 cpuid

0_2_00AE0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B38195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00B38195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B1D27A GetUserNameW,

0_2_00B1D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AFBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00AFBB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AC42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AC42DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B41204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00B41204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B41806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00B41806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true	false	unknown
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
s-part-0045.t-0009.t-msedge.net	13.107.246.73	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.186.129	true	false	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.12.dr	false	Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.12.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content.js.12.dr, content_new.js.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.12.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	7934cda1-aed6-4925-9668-4a6f6f9d63d3.tmp.13.dr	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.12.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.12.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.42	s-part-0014.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
142.250.176.206	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.251.40.174	unknown	United States	15169	GOOGLEUS	false
23.200.0.9	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
13.107.246.73	s-part-0045.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.35.164	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502958
Start date and time:	2024-09-02 15:29:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@94/517@20/13
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 43 Number of non-executed functions: 309
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 74.125.206.84, 13.107.21.239, 204.79.197.239, 13.107.6.158, 2.19.126.152, 2.19.126.145, 142.250.185.99, 142.250.186.67, 2.23.209.130, 2.23.209.189, 2.23.209.185, 2.23.209.132, 2.23.209.192, 2.23.209.183, 2.23.209.188, 2.23.209.186, 2.23.209.182, 20.103.156.88, 199.232.210.172, 142.250.184.238, 192.229.221.95, 142.250.186.106, 142.250.186.138, 142.250.185.74, 142.250.186.170, 142.250.184.234, 216.58.206.42, 172.217.16.202, 142.250.74.202, 142.250.185.106, 142.250.186.42, 216.58.212.170, 172.217.18.106, 142.250.185.138, 142.250.184.202, 172.217.18.10, 216.58.206.74, 142.251.40.99, 142.250.80.67, 142.251.35.163, 142.250.65.227, 142.251.40.163, 142.250.72.99, 142.250.80.99, 142.251.40.131
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, iris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-000
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:30:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
14:30:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
14:30:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
14:30:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.42	https://protect-us.mimecast.com/s/FVibCzpzxLsxEMXAhgAOBC	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
	http://border-fd.smartertechnologies.com/	Get hash	malicious	Unknown	Browse	border-fd.smartertechnologies.com/
	https://protect-us.mimecast.com/s/4MrPCrkvgotDWxrNCzxa8p	Get hash	malicious	Unknown	Browse	www.mimecast.com/
162.159.61.3	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	tXwWf89bXc.exe	Get hash	malicious	Unknown	Browse
	0m4MDxiRIE.exe	Get hash	malicious	Unknown	Browse
	UPrvrJFnEx.exe	Get hash	malicious	Unknown	Browse
	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0014.t-0009.t-msedge.net	https://pharmakon-my.sharepoint.com/:f:/g/personal/338im_apoteket_dk/EpWA_muYfpxOnnnQ0_fk-tQBEy5E4DvZpPAK2CbbLIvKuA?e=ORDGlm	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	13.107.246.42
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	13.107.246.42
	https://sites.google.com/view/bzwyy/accueil	Get hash	malicious	Unknown	Browse	13.107.246.42
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	KbUI.exe	Get hash	malicious	Remcos, PureLog Stealer, XRed	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	tXwWf89bXc.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	0m4MDxiRIE.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	UPrvrJFnEx.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
s-part-0045.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	13.107.246.73
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	http://www.kraftpaints.ro/eve/pdfonline-3d2-new-bg2/pdfonline-3d2-new.bg2/pdfonline-3d2-newbg2/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	https://login.ap-financier.com/TaqWmoGv	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	https://nexgenodisha.in/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	http://l9sa.github.io/	Get hash	malicious	Unknown	Browse	13.107.246.73
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.cntravel-engine.cc/login	Get hash	malicious	Unknown	Browse	104.21.87.200
	ACH_Remittance_Copy_Thursday-8302024_16d4b35684bb4196eb8133664f36ad3e7a830549.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://my.manychat.com/r?act=2b615c164140e23268efd3fe27e6a470&u=7887682621342430&p=103103452689925&h=e6e39ebf61&fbclid=IwZXh0bgNhZW0CMTAAAR021mbY9mpccGqDYCuiTxqNRBzwubAWllyd-mJU2PSxENFYPR8J6EzZk7U_aem_TxGyVk0bCsopUu3lS-60uA	Get hash	malicious	Unknown	Browse	1.1.1.1
	CONG TY TNHH RAISING VIETNAM - USD 5850.00pdf.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Bill for the Month of August.exe	Get hash	malicious	FormBook	Browse	104.21.72.245
	RFQ September Order PR 29235 doc-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Modifications_List.one	Get hash	malicious	AZORult	Browse	172.67.162.36
	ListenNowMsgs000037Secs_wav229.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://fish-container.vercel.app/	Get hash	malicious	Unknown	Browse	104.22.21.144
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	1Td9Py5FAy.xls	Get hash	malicious	Unknown	Browse	13.107.246.67
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	REQST_PRC 410240.exe	Get hash	malicious	FormBook	Browse	20.2.249.7
	file.exe	Get hash	malicious	Unknown	Browse	52.123.243.70
	https://pharmakon-my.sharepoint.com/:f:/g/personal/338im_apoteket_dk/EpWA_muYfpxOnnnQ0_fk-tQBEy5E4DvZpPAK2CbbLIvKuA?e=ORDGlm	Get hash	malicious	Unknown	Browse	52.105.163.41
	a5a5af3b-ae4b-2746-d08a-67229fed50bd.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.28.48
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	PO 18-3081.exe	Get hash	malicious	FormBook	Browse	20.2.249.7
EDGECASTUS	ACH_Remittance_Copy_Thursday-8302024_16d4b35684bb4196eb8133664f36ad3e7a830549.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.141
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://pharmakon-my.sharepoint.com/:f:/g/personal/338im_apoteket_dk/EpWA_muYfpxOnnnQ0_fk-tQBEy5E4DvZpPAK2CbbLIvKuA?e=ORDGlm	Get hash	malicious	Unknown	Browse	152.199.21.175
	BAT6357377.exe	Get hash	malicious	FormBook	Browse	72.21.81.240
	Status Update 2HCCR.html	Get hash	malicious	Unknown	Browse	152.199.21.175
	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.55.235.170
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	tXwWf89bXc.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	UPrvrJFnEx.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	mirai.mips.elf	Get hash	malicious	Mirai	Browse	172.236.2.84
	https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E	Get hash	malicious	HTMLPhisher	Browse	95.101.148.20
	http://staemcommunmitly.com/giftcarts/actlvation/feor38565Drgs7	Get hash	malicious	Unknown	Browse	95.101.149.47
	file.exe	Get hash	malicious	Unknown	Browse	104.70.121.171

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.cntravel-engine.cc/login	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	http://forms.gle/QGa69wazZ2TEx5UGA	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	ACH_Remittance_Copy_Thursday-8302024_16d4b35684bb4196eb8133664f36ad3e7a830549.html	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157 184.28.90.27
	https://login.widows.net/common/oauth2/authorize	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	ListenNowMsgs000037Secs_wav229.html	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157 184.28.90.27
	https://fish-container.vercel.app/	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	http://cache.cloudswiftcdn.com	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	http://indepahote.com	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20990
Entropy (8bit):	6.065215760774636
Encrypted:	false
SSDEEP:	384:qtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSyvlsZI9MlngV1PdQYT3W4Ad4nM:OMGQ7FCYXGIgtDAWtJ4nOvqZoMlngV1K
MD5:	3C27BFCF2D9941F277A134B299BD5441
SHA1:	A0EE3BA84E0E86F10726D7FB3A119BE83E56F739
SHA-256:	0E4B030ADEEA4AB41F1B8AA20B07FE2125DAC75DD6160FCD91DCEFFD9CE8E14A
SHA-512:	4967CEDB556C9B1C1D491CC1602C153D20D6F0032985549319C34511457DFD56FC5C53C5FC538D205B88503C2F90DF3FF27982559362ECF61770656984A1782E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369757400123830","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\23649bfe-ee63-41e0-bca4-b216ee02afa2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.4952220929122175
Encrypted:	false
SSDEEP:	96:0q8NkGS1fpcQEFF58rh/cI9URoDoto69Bqava8FUaJkncLSDS4S4SDSJI4a:/8NBSbcQE8eoDU9fUWkn6
MD5:	F22EFC114FD8C8CF6D4963A73B044AE9
SHA1:	0B8BF4C1E08528D18DF7DFAF20FF1EC5DABD934B
SHA-256:	B41D526092DB012027558458E4CDC0568090159FF61F8806DE285909621A6BB1
SHA-512:	D98766A3A1A649742780E1CECF345D742DD6DD9DEF5EEEF062781A415DE450B7434B173A0546C40D4C48303288BD4410BE4B54287469782DC9F1BEBD0C4C81DE
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9Wm

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2989ca2d-066d-4fa8-861b-038d411f27a3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20990
Entropy (8bit):	6.065256915851194
Encrypted:	false
SSDEEP:	384:qtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSyvlsN9MlngV1PdQYT3W4Ad4nM:OMGQ7FCYXGIgtDAWtJ4nOvq3MlngV11I
MD5:	023A630CF4E8E9662276ABCA6A989EBC
SHA1:	4432BB1A72B0B616ECE7E4655BB66C9F80D0FA7E
SHA-256:	866A2F0BEDA40E3D5AA16B3008D913F6769F0D8DC7D8A0959E4A05930C868F21
SHA-512:	16C5FB76C48348CADC64EB08CB4C333FE6917518AA58F188816F7CF31B3BED345C55306736F3E08704E6FA2C49EBC8A78F567DEA8943B60A45283D42EBB81E73
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369757400123830","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5488f114-c52c-400d-b199-0e37a3a9bd60.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71384
Entropy (8bit):	6.073051306006892
Encrypted:	false
SSDEEP:	1536:OMGQ5XMBGVU2jCqtaYf6afu383YJ3Se/NGqepjBYP11bM:OMrJM8VnXtCY48KS1qejBYP11I
MD5:	61E1F338D3CABC575B5BC685783732C7
SHA1:	C3598C46AEE08A800D320BD6EF010E560D742058
SHA-256:	57BF2E9B6C3C2245B83813793B86989FAAFAE4AD85C9CD11918E1ABDC0067C5B
SHA-512:	7DE694CCF4030BBE175A87B27F0B0D7651999A0810A0D8796EA1277CDB30ED7A23508FB1F663C8CCD9F6B23110BFE506E0C54D17012E8A5E851DA3D0A0857FFE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369757400123830","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\67da2b36-3723-4efe-aba4-7cc22a07e8d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.538326018914826
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTa7HwF1zBC9QxGTfyikzJdXBuBuwBr48aMNhttZX4CQQRCYfJ:YuBqDPafpcQFukGPegBzBU89nZMB0
MD5:	029F5023F53CD54349BF79BB7A7DA486
SHA1:	D68BC0EBD002D1EDA78F3C2C17CB9AAB69C70BDF
SHA-256:	00EA9878B05EBCC64CD6E631FB83C461EEA719377B79895CC9C3BBA91380C965
SHA-512:	16AC66E21067E336FFE4D58CBC9F07E831D22D7A62D258F23E4D14E17294E2CDDC8A1FCF7E87DBDD66F1DA8CE96C4AC114D944A3210B4DBB1C9530B7F4F796FE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369757397984498","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725283797"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\82bf945a-8e90-4ddb-a8e2-63476fc5aaf9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20990
Entropy (8bit):	6.065226766318084
Encrypted:	false
SSDEEP:	384:qtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSyvlsx9MlngV1PdQYT3W4Ad4nM:OMGQ7FCYXGIgtDAWtJ4nOvqrMlngV11I
MD5:	151F8EE429D3DD83C90AA0723C7601D0
SHA1:	69A414571E512603C26AED750AB9E83B2C281690
SHA-256:	05312186E604CA829A0728CA0B0EFD0381766DCCE6A16313F1C1B5666F8B9115
SHA-512:	09429D91B2801967310A404883DDCB0594731AA3F21892E628A4244B3CEB94837ACC3FA57D7A8B4E3E4D81907FB0254E971B4AA8B17AE2C0FEB58E4E7D3ABD9F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369757400123830","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\99f71123-2dfe-496b-bc10-0baa77568163.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.5850141508263365
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afpcQFukGFekHB+GGdrxkvBU8KjR11aJkX3cAwlRdYEvB0:Xq8NkC1fpcQEFFBBqava8a1gJkncFJvq
MD5:	18D8857B4184FE4EF600C9D05F529655
SHA1:	C9A33EAA7F8E2A39CBD9FF119A2E58CC75057C49
SHA-256:	DADAC7DC09B216DE080A471CF2883B29F6F27DA84111C66BC506AA0809E2422A
SHA-512:	C7C8C0D121B333CDF89811C5051C1F236B3AC66AC9C2F92C67507BA8123D4543C641D510926BBA2B7A5158C7BEC9D903979A138478FD4A2F87BA78DA9E830AAF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"policy":{"last_statistics_update":"13369757398023462"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\9d116b98-d1fc-4473-be8f-1c86ac94cfc6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71423
Entropy (8bit):	6.073119576803724
Encrypted:	false
SSDEEP:	1536:OMGQ5XMBGSU2jCqtaYf6afu383YJ3Se/NGqepjBYP11bM:OMrJM8SnXtCY48KS1qejBYP11I
MD5:	B1EA4C0ADDE9D7CE5C2134774BF18F6A
SHA1:	C20C88A107D3BD35C81A78F35E935ACE610554C0
SHA-256:	E7350ED3112946DB90CD5139A46219F7D23D600E568B48F340889CF7122B9A73
SHA-512:	CAAABC0B2E997F05D1E32B274F1F2564A5AEC56C8804E4115649D68A243A9D8177A3F67D9283D3C119F4BB8129BD0F4D757432FF155A6626DE14C34351AC6951
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369757400123830","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\9ea6f7f0-a5ef-40ea-bb7c-fa7e7254c505.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.5850141508263365
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afpcQFukGFekHB+GGdrxkvBU8KjR11aJkX3cAwlRdYEvB0:Xq8NkC1fpcQEFFBBqava8a1gJkncFJvq
MD5:	18D8857B4184FE4EF600C9D05F529655
SHA1:	C9A33EAA7F8E2A39CBD9FF119A2E58CC75057C49
SHA-256:	DADAC7DC09B216DE080A471CF2883B29F6F27DA84111C66BC506AA0809E2422A
SHA-512:	C7C8C0D121B333CDF89811C5051C1F236B3AC66AC9C2F92C67507BA8123D4543C641D510926BBA2B7A5158C7BEC9D903979A138478FD4A2F87BA78DA9E830AAF
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"policy":{"last_statistics_update":"13369757398023462"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\fb2321b2-9ed0-4cbe-8841-0f8a76aa1370.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D5BDD5-1D54.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04017626518313886
Encrypted:	false
SSDEEP:	192:04sUjLYiVWK+ggCNGGJZzKFd9XvYFPg+znhHBNEXohcRQ8N1cAn8y08Tcm2RGOdB:2UjjlpMt8hh9Q7cA08T2RGOD
MD5:	4FE5ECC0263DE99AA518A4E03426589E
SHA1:	5D4C278B7FB2E29A9968FD3B6C2404AC70F0FE7C
SHA-256:	01E747800698079CCCCEC48760FF9CD2DBAD514B592E67AADBB839FC36F1EB36
SHA-512:	703F01F5E00E447C071DBF316FA844FBA2C3791DFD21E081638FE9AE3AF2F51ECF9B2C1B6978D802EDA7EC80886CF9B47A3C08FD52CD0FA565ED70AEDD09765F
Malicious:	false
Preview:	...@..@...@.....C.].....@................`..8P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".cpbqix20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./.....................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....\|?5^.3@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D5BDD6-1E58.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4576869111373362
Encrypted:	false
SSDEEP:	3072:voAThaQRMm1WtKMl0MLi6sd3w/DWsaEw2c3dfTL8SeXnrnhMg1HFITjpsStOpmUL:gbI+KYnhMaH6Rw4aP4aHI7P/
MD5:	4756CB2D3C1DD6F34FA896C87580C278
SHA1:	89259E44F5EE8E5EE869FC3F5C05F5A07D23E7EA
SHA-256:	A42D632DF0F8EEE9C709E6D0F86D7937CA66C702DE20011409F5829527C70ED5
SHA-512:	E7F24C3094FA46253116CD029B0170FA6EDAB7878CFE12EDF1FCC814B44CAC96158215930606DE17BF7CEABA339EEEAD2D9870AA684DF6B49974297C3F03DB09
Malicious:	false
Preview:	...@..@...@.....C.].....@................Q...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".cpbqix20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.15910394510481
Encrypted:	false
SSDEEP:	3:FiWWltl4WItVIa4HSRqOFhJXI2EyBl+BVP/Sh/JzvIcOEdIVIFI1Dlkl:o14Vqa4yRqsx+BVsJDIcO0
MD5:	B05293ADADD67101637E187A70E340C2
SHA1:	5584407CF8489508807DDE612D38487E682BB3FB
SHA-256:	915AB1A529A0BB0ACD8CE95C7BA2F252AA2B07CD2C8BA50C124754A6C4F1C3D5
SHA-512:	376934C09826F4E95073747F954A0D7B8333CF6A3697BF30D69F0520E857943C091C89FF2EEA5FA92E5DAEFB4D631B47F9A1073C1A2B1E41AA471F1FD9D3F0C3
Malicious:	false
Preview:	sdPC..........................-H..:v...."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................a2912218-8cec-4329-a59c-df0fb30d31d1............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\34f150ea-4d85-4e4b-b111-ec2d5d7c3c51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	4.982572968447468
Encrypted:	false
SSDEEP:	96:stHqfiis1ssb9KRqHN8zmZs85eh6Cb7/x+6MhmuecmAehLQK2M6/EJ:stHEsMqHNkmZs88bV+FiAOP6MJ
MD5:	5BF3EFF430F32B7CB62107F978254CA3
SHA1:	BD302F8017C55D2D295219E6F920C6221CB014FB
SHA-256:	519F4ADC1EBB4B988CF9969B7C854AEC062A75F658360BFBC0743B0DA6E83C98
SHA-512:	4BC9E045A1474FC85AED110D1752A27C85448BC5F3A9CCFD6BC4F76E2D6F72839F61E9CEB99073746DE8D5DC445E439C0090035E28295F6E16E89FA998B76E9B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369757399233643","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369757400077524"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.3215396965784
Encrypted:	false
SSDEEP:	192:AAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:zOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	8DD491B51D952837A22ADC122718A7B5
SHA1:	CFB0146E31368BA45C6B9179A6156751D7C61A54
SHA-256:	33A3F0F8CEFDE005A9F3EB505019130C0019F6A71E72EA82F6F910EA7B375C95
SHA-512:	29C214418AE47C7DC4A17BF06A27A4E05490A322E6B4C0DEEF4F054196EEEB60998B6DAA7073979C985D20686335A373F3212F8F9BEF73DD8DAA9E125EAF5031
Malicious:	false
Preview:	...m.................DB_VERSION.1...@.................QUERY_TIMESTAMP:arbitration_priority_list4...13369757404186088.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.075335687877289
Encrypted:	false
SSDEEP:	6:PfSM1wkn23oH+TcwtOEh1ZB2KLllAmL4q2Pwkn23oH+TcwtOEh1tIFUv:P6rfYebOEh1ZFLnAmL4vYfYebOEh16F2
MD5:	CE65804D6797BE78B613E0FD57795A13
SHA1:	19E5A17BE606349E24504669308FE5F0F0BE3EC1
SHA-256:	63571907127E6F78F7CB308F1B7966D99D3925F576B2DA51C8829D975AD2BD4A
SHA-512:	FC2DE25484F0CF9E810BBC8A75788B55FC47B0AE636D91BC9125F048044A2E35B0A04311681D0BB6ADEAF9F3FB8786FC08A53F34D8D17D77431A39AE426F4B62
Malicious:	false
Preview:	2024/09/02-09:30:03.323 22c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/09/02-09:30:03.543 22c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04420340891742684
Encrypted:	false
SSDEEP:	6:/Fii2+CrTtUkM/lXH/hep8ps3MtQNune8kll6swl//ld:du19EXH/hQW2Enu/677
MD5:	F22017136F3460AEB03BAE87C22A337C
SHA1:	386E7C0EE2AF416A150B0F28B6879EC9E42951A7
SHA-256:	2EDA780198CF726EB0EC031694F5C5D1B2B3046095A35C4040BB730DE5E45948
SHA-512:	44934DFAEB1A806F1AD4790A5FF1C8703F25ADA03D94DCE876E0008A9D106114FED6A20F84CF7D0B94D0A53BA1FEFDAB62DB88A0EF17A356D84132E87521F459
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09560281002758295
Encrypted:	false
SSDEEP:	48:qV4A3esULhQV4XesrAe+6NUeGfT3lWp4:qV4A33UFQV4X3rA96NLGL3L
MD5:	21B2E8E33E1FBC5A45011BFEFEDBC9A3
SHA1:	9B1A14017C670209AB46823D44385A9C9463DBD9
SHA-256:	BF98EA5A84116BE63A90EE33336F0AC8E0A795AFC10BEC39DF0072D3354D7B60
SHA-512:	7C93B5DDB285BFE0D1D588E5FCE266D1F329E24CBDBA62D044B11F4F2D77D6126AA7E22E73A63F0DC8B62B60241120BDFDC8A1B1C507010647110AE7CB56FD5D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.28322119118342215
Encrypted:	false
SSDEEP:	192:DEtmkNJZbtMXlEtmkNJZbtMXBzMwhfJZbtMEVMwhfJZbtMEe7ZFqZmJZbtMMPUk:D7uJtMl7uJtMBowrJt/KwrJt/somJtL
MD5:	F0A021EEB9BB52CE5A96467A178752B8
SHA1:	B784C330323E58B385A686CFF7143FA74EED79A7
SHA-256:	C6C349019E339E525C0133BCE06E9A9D8599138B3759A4F245242DE255398A1A
SHA-512:	6D27D947F713A942CB75DE002B3664DA615B566EA3A4982D4A90CEE39E71091B59CB46CDAEBE009A69284DF60CAA2383B5A5B6CB694048AEB39AEC8287828BCF
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulBCllll:LsP//
MD5:	40746BF53501BFF50F37FC53243B168F
SHA1:	61CF5FEE5A944FFABC99BB3E38A1ABEA63E91A42
SHA-256:	297CCD7DDB556C041C28464D50172B6FD09BE460141E4A10C7D73EAF4DD0AE94
SHA-512:	01E0053C1C373DC59E53EF9C6D13473EF82E32B538D77C52CE4336AD1B3FFD03B46F22C9FD810D8E63AB1B5432EE5BB4FBA6FCCCCF57585855D10C7CEA941157
Malicious:	false
Preview:	........................................1e.8../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:Na+ctTEOza+n:I+cqE
MD5:	ED6309D0458ED22C7246F5E67FCAC231
SHA1:	C80C7F847A19161EAD429B0FE63EF60861B7729E
SHA-256:	498F2B133A3B9684A0FF604B144D448F9E58B9024E6FC10837200AB812C9AB97
SHA-512:	052FB40D475B20216CF95B978FF183E48CC3FAB4495CB24A61FB00E0E9A9B901068F398BC5EB16C60883C4FC06B8DE77BBF3A0C5AD0BC6AFF9F978DEFA6FE190
Malicious:	false
Preview:	(....?..oy retne..........................\|8../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:Na+ctTEOza+n:I+cqE
MD5:	ED6309D0458ED22C7246F5E67FCAC231
SHA1:	C80C7F847A19161EAD429B0FE63EF60861B7729E
SHA-256:	498F2B133A3B9684A0FF604B144D448F9E58B9024E6FC10837200AB812C9AB97
SHA-512:	052FB40D475B20216CF95B978FF183E48CC3FAB4495CB24A61FB00E0E9A9B901068F398BC5EB16C60883C4FC06B8DE77BBF3A0C5AD0BC6AFF9F978DEFA6FE190
Malicious:	false
Preview:	(....?..oy retne..........................\|8../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:pFH9Ebm:PHqbm
MD5:	6043CA17CB71A2DC9F7B97805B9F035D
SHA1:	567255E6A353271BBA27B98EFD43EA4E34F9628B
SHA-256:	4D7CCCC0A18B78F936144165E1040C5EB2B3F42EF0342E61BEE82C825E764658
SHA-512:	3F61822D8B98C77C27210C07F5509D04E9FDFC5A728CACB8264DFD139C6DD8ED35BFEA8DD46F66F0E5798CF4485F533F43AF35BA2E5B6BCBEAF9DA836A0766EB
Malicious:	false
Preview:	(...4.Y:oy retne..........................\|8../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:pFH9Ebm:PHqbm
MD5:	6043CA17CB71A2DC9F7B97805B9F035D
SHA1:	567255E6A353271BBA27B98EFD43EA4E34F9628B
SHA-256:	4D7CCCC0A18B78F936144165E1040C5EB2B3F42EF0342E61BEE82C825E764658
SHA-512:	3F61822D8B98C77C27210C07F5509D04E9FDFC5A728CACB8264DFD139C6DD8ED35BFEA8DD46F66F0E5798CF4485F533F43AF35BA2E5B6BCBEAF9DA836A0766EB
Malicious:	false
Preview:	(...4.Y:oy retne..........................\|8../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlhrul:Ls3hrq
MD5:	E74B7300696C5E50412E434159507CB9
SHA1:	AE467BB4CB491721A3893C1BAF528DC1F4BCF7E3
SHA-256:	FB4419C3F0F3E0622D34AE7380A1660219387461BCA13C1E6F9F9C78D2E514E8
SHA-512:	F5260F8A35373D829FC9CEFAFB50B5E193A9DBC751232A647825322C857C1E900EE2B522F95416A0C63E80FA20353BAA6C87DE4E98C1C4817ADA844FECE3551D
Malicious:	false
Preview:	........................................J..8../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	375520
Entropy (8bit):	5.354134781174854
Encrypted:	false
SSDEEP:	6144:iA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:iFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	629E33704A164CE304DF52D72BDC287C
SHA1:	3BF93B1826E75552C0C35A0589966370552472C6
SHA-256:	77A5249D1AEA9EE9F5D0FBDA53F5B46C2B8E8D4DFBB6D5B1BDACBCCDBCBF26C5
SHA-512:	DF7E61047A772759B3507F83294DB338DF2480D8407838A7B320550530275B40ADD57085E9E600BB374FBF1E32E462F051A5B839C965A01714443FF87C69249A
Malicious:	false
Preview:	...m.................DB_VERSION.1..Mq...............&QUERY_TIMESTAMP:domains_config_gz2...13369757404331708..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.155761216955955
Encrypted:	false
SSDEEP:	6:PT1wkn23oH+Tcwtj2WwnvB2KLllEFAq2Pwkn23oH+Tcwtj2WwnvIFUv:PCfYebjxwnvFLnEFAvYfYebjxwnQFUv
MD5:	343A7F889FB7B1A5DB353ECD34F9F1B0
SHA1:	A9FCB537680A6958537F4418611D2E9734925C30
SHA-256:	DBC6A7FE30E550D1364D28CCBD21D12651988783A3DB6B307B4DB91A252FC0C5
SHA-512:	D58BFEA3084850991393EC01C4B702B87BC50B7FDAA9097BA8DD03666BD0D96D8B9DF10567CD24270C886D83CA62ABDB8B2AFC43115C1F5AD3674F514FA860BB
Malicious:	false
Preview:	2024/09/02-09:30:03.523 22e0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/09/02-09:30:03.681 22e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	358860
Entropy (8bit):	5.324616729940552
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R8:C1gAg1zfvk
MD5:	E9B1EB6D956D821FA2F791380A004011
SHA1:	EF9EBD1FDBA0BBBBE71A926A237BFEA88C4B146D
SHA-256:	8643811C2F1EF575AC65D6909FC679A3E90A4047F3BCED1AA801095B629E3A35
SHA-512:	B4BC5E2B09638FB2A36591D64A2BC475EC2AFF881DBF378079BB1540FF9F8BB75912D7984C2FEEC2DC5C97C82094D5D3946C98D049C61B2016AE7AF55A1171EC
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.180464949393975
Encrypted:	false
SSDEEP:	6:PpfdVFU+1wkn23oH+TcwttaVdg2KLllpf0+q2Pwkn23oH+TcwttaPrqIFUv:PpFcfYebDLnpM+vYfYeb83FUv
MD5:	94DD41629B0D9807CA82F09A664521CB
SHA1:	A4828CE223915C67AFD97F41BFCA22B878C5A4C1
SHA-256:	3AFAB92BFA1031D70D93C04B87484EA4A266BAB7A63A3D4E5F2E19EA34541270
SHA-512:	6CD7DCC13BB56E0773D009B7256C00007D0A6C5FAB77C3F0B635440CB52684C9DDA1A5607BED265FB66309CD7F8A72BDA5610A2B161236C9FEFD8C24A5E9C654
Malicious:	false
Preview:	2024/09/02-09:29:58.720 1f2c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/09/02-09:29:58.730 1f2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.176474190306847
Encrypted:	false
SSDEEP:	6:Ppfe1wkn23oH+Tcwtt6FB2KLllpfbXR+q2Pwkn23oH+Tcwtt65IFUv:PpBfYeb8FFLnpl+vYfYeb8WFUv
MD5:	5FDA7961DECC4CE5307BF01B02AB4629
SHA1:	D7242834ACC103E6DEE20143B3BA6D1EC7E3FBF1
SHA-256:	B6E94779D49DBDDE9F73B67B82388A50BA81AFE972FBE9DDF9822FA27EF8AF27
SHA-512:	70434114776CA0A44F5F7FEB89DA753290BBE5CB497FBB841B47057FF523920C3B5241A280A41D110030CBA29C27BF0F82B468172097030CC4231C965D4B56AC
Malicious:	false
Preview:	2024/09/02-09:29:58.732 1f2c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/09/02-09:29:58.742 1f2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.117809945672931
Encrypted:	false
SSDEEP:	6:P7FZBFFB1wkn23oH+TcwttYg2KLlls0mt+q2Pwkn23oH+TcwttNIFUv:PV0fYebJLnwovYfYeb0FUv
MD5:	1EF6A13B16767BF07C221D7E20D00913
SHA1:	DF5852BEFE1E74E61E08B26E032AE865A4C64B1A
SHA-256:	0C67B83D1DD0CED9B8E5DA45FE7F2E2681C27F0B7235D714281FB8648F6E79C3
SHA-512:	D29BA49E4B856E4B9A2355889838B9BFF201CF788DF7FAE5C9983419FCA3BEF2EABD3F2DBAB036779D3805858AF0CDAFB4C6C6354074B882706E2172C852A715
Malicious:	false
Preview:	2024/09/02-09:30:00.330 1ef8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/09/02-09:30:00.368 1ef8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl2cBl/l:Ls3Vlt
MD5:	3544493CFB842F0F2D175E3834F7AF5B
SHA1:	71933DD481AE8D060CB9ABA59FAF1BF1B053B0F9
SHA-256:	A15371C11D7C87C7A31FE41093C705FE1BBA013F04A6B8A882A43C3BC4BB0AC3
SHA-512:	DC5783CC7DE91435A4247EF7DE57C1F2B12E4A86235431F5663D4378E09A9B9B5E9053BF51FF0EC7AF669DA60D7A252E3A15ABB79855C4ECCB21DEC2C68CF0B7
Malicious:	false
Preview:	........................................A..8../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:Yl9tFlljq7A/mhWJFuQ3yy7IOWUl8l9otdweytllrE9SFcTp4AGbNCV9RUIEU:IG75fOIlud0Xi99pEYeU
MD5:	B9A11241FFDE76812A0D9BC408B461F9
SHA1:	5C15C3D4B49A1D34231292897266D644F182922A
SHA-256:	F63FB343E1D2F61813ACE62C29E4B6C87C4FE1BEA2F0DBF26C1F612F6242D6A4
SHA-512:	0DE041E3D9BD5AD6158A7B879998A8146A2708A91A7CD9C9E73E368F4580A816AF92888D122808F40EFF4B1BA6E1400B21FAE46F15C239F4CDC4B922CB2D2375
Malicious:	false
Preview:	............y.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.2012781003819
Encrypted:	false
SSDEEP:	6:PM1wkn23oH+TcwtRage8Y55HEZzXELIx2KLll/QL+q2Pwkn23oH+TcwtRage8Y5i:PrfYebRrcHEZrEkVLn/Q+vYfYebRrcH0
MD5:	01BEF6B5CC91A6473095023785439D9A
SHA1:	AB2EE383FBD378EF28C6DFAF424EB212B7F0BD85
SHA-256:	0010BD566104738AD6CE66C4FBF0C94FFE338B161A219E35D3DDEB0028D10E82
SHA-512:	238B5F0B79D55FED593A3CF6B10759FFCF97F1DE0FEEA7003F6589084100DBE876323D6C036D24C908294920741B759E9A9911EB3A17ECC8FF9096DD5180B333
Malicious:	false
Preview:	2024/09/02-09:30:01.455 1eec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/09/02-09:30:01.468 1eec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.214880637127332
Encrypted:	false
SSDEEP:	6:Ppf9SM1wkn23oH+TcwtRa2jM8B2KLllpfBdjyq2Pwkn23oH+TcwtRa2jMGIFUv:PpVSrfYebRjFLnpZovYfYebREFUv
MD5:	B9303FC3C14AD4B4BEC0E59A2D42A8B3
SHA1:	0A73A30A7A4A136458EDB83008B4C77FB769B95C
SHA-256:	48B71F548DC46DE56FEF96BB8489182E70ED1DEFFC2D4EB3650017400A1959BA
SHA-512:	73560533F0612A5C220BB1AC6DC38C7C5C338192F25337F3D6D6F3B8490AA3FA412F73730D8121AD905AF2E502114A549EDC124E60DBBEC1E8CD424D1E339DD0
Malicious:	false
Preview:	2024/09/02-09:29:59.656 1c14 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/09/02-09:29:59.793 1c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\096e2e82-9801-4c33-a64e-2ea22b58b48b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.89042451592505
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDHERW6JfYoR6oJbRHeHBYMKWKWMS7PMVKJq0nMb1KKtiVY:YHpo03h6ubIa4MS7PMVKJTnMRK3VY
MD5:	633DDD1B4920EC5BE074DBE9C025C0CA
SHA1:	544DEC5ED8BD3FBAB234940BEA45390B5CEF13D1
SHA-256:	8FCAE56F81D49DE83AC45BB8848E818C99462EEE03D017124E895D39630B3889
SHA-512:	CB89ABA6C2D59A7D520BD1BBDB85CBDF5CFBBE3DC9DFD02E06071F8597E3EB0D3B3BE3587AE58870B92127379A2C875A856F11B6792D4A68C5204837814549A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\8f7be601-737c-4596-baf0-7e8c03d27bc3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3be40.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7607459312297402
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkLF:uIEumQv8m1ccnvS6U
MD5:	0279C8A748EB0555AD9689FB7AF8330C
SHA1:	4E416F927D7C49BE299A0E497E220D5F763BAFAB
SHA-256:	3BA11B9E91F69C3DCA454536E3F6AAE3408999AF652C60992A69871F33A2B6EA
SHA-512:	3E777E8246E7317DF88601EBF57108E5C1B369C426AB4273D837D2CCD31DAEEF0DD1D2979A7239460C31B3FE6AAAF598F3E6CBD5706E0AB7ABD209F39F0635B5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF29dbd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\d2def55b-1eb6-45e3-af9d-1d4e0b046ec2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\ef66c65d-6663-41b0-9fce-825728d84a22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\f16bc2f3-7c29-4153-b285-114ba20f8a97.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.972434176303477
Encrypted:	false
SSDEEP:	96:stHqfiis1ssb9KRqHN8zmZs85eh6Cb7/x+6MhmuecmAehNN2M6/EJ:stHEsMqHNkmZs88bV+FiAcP6MJ
MD5:	674AF2C956E15ECE1B98A24442273B80
SHA1:	A406563566B3AC888E38F92D818BEE42AA4A1791
SHA-256:	53373A9FFDAD653C26A0D4AB4A61D0A80DE23145E04BCC24722F2113A6FEB0C9
SHA-512:	109412F221106FFE822E628B31D865FE4CFB4CF58FCD175DD974447748DE77D587459E4F5856E4919E03BDE3A9F7A0BC64B8DC28627A9B8E0530E42D5E5F1BD3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369757399233643","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369757400077524"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF32da8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.972434176303477
Encrypted:	false
SSDEEP:	96:stHqfiis1ssb9KRqHN8zmZs85eh6Cb7/x+6MhmuecmAehNN2M6/EJ:stHEsMqHNkmZs88bV+FiAcP6MJ
MD5:	674AF2C956E15ECE1B98A24442273B80
SHA1:	A406563566B3AC888E38F92D818BEE42AA4A1791
SHA-256:	53373A9FFDAD653C26A0D4AB4A61D0A80DE23145E04BCC24722F2113A6FEB0C9
SHA-512:	109412F221106FFE822E628B31D865FE4CFB4CF58FCD175DD974447748DE77D587459E4F5856E4919E03BDE3A9F7A0BC64B8DC28627A9B8E0530E42D5E5F1BD3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369757399233643","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369757400077524"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3a2d8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.972434176303477
Encrypted:	false
SSDEEP:	96:stHqfiis1ssb9KRqHN8zmZs85eh6Cb7/x+6MhmuecmAehNN2M6/EJ:stHEsMqHNkmZs88bV+FiAcP6MJ
MD5:	674AF2C956E15ECE1B98A24442273B80
SHA1:	A406563566B3AC888E38F92D818BEE42AA4A1791
SHA-256:	53373A9FFDAD653C26A0D4AB4A61D0A80DE23145E04BCC24722F2113A6FEB0C9
SHA-512:	109412F221106FFE822E628B31D865FE4CFB4CF58FCD175DD974447748DE77D587459E4F5856E4919E03BDE3A9F7A0BC64B8DC28627A9B8E0530E42D5E5F1BD3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369757399233643","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369757400077524"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566928415251664
Encrypted:	false
SSDEEP:	768:9TYb38WPoWf0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2/sFWrw+pGtum:9TYb38WPoWf0Tu1jaDUFzbtV
MD5:	05BC31B859DD227B9472C4F5BBF7E993
SHA1:	831E17165E9383B26078C61885A0A2148853C76F
SHA-256:	890CEACC253747C3B1A98161EE0869E5265DB54F6EA7F41A92F32012AD05A8F6
SHA-512:	90DC4A571DC25A9A3131248A1DEA91DA836945D29044B0912270A03DE7F947F80D6CD68C36D2CADCECA89950F6EB38B560213110E4B9F2E278B37410095B7C66
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369757398675182","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369757398675182","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2fd32.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566928415251664
Encrypted:	false
SSDEEP:	768:9TYb38WPoWf0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2/sFWrw+pGtum:9TYb38WPoWf0Tu1jaDUFzbtV
MD5:	05BC31B859DD227B9472C4F5BBF7E993
SHA1:	831E17165E9383B26078C61885A0A2148853C76F
SHA-256:	890CEACC253747C3B1A98161EE0869E5265DB54F6EA7F41A92F32012AD05A8F6
SHA-512:	90DC4A571DC25A9A3131248A1DEA91DA836945D29044B0912270A03DE7F947F80D6CD68C36D2CADCECA89950F6EB38B560213110E4B9F2E278B37410095B7C66
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369757398675182","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369757398675182","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.133879967321214
Encrypted:	false
SSDEEP:	6:P+jVM1wkn23oH+TcwtSQM72KLll+ZXlyq2Pwkn23oH+TcwtSQMxIFUv:PWrfYeb0LnYXIvYfYebrFUv
MD5:	BAC40F08BCA22072003DECE26530449A
SHA1:	7AF51BB78115FC5B7E6FD41BE72AACD3F9642A0A
SHA-256:	C46CD36F5862A13C061AF1D4071C5F1B9A07D5D8C3FE5A00631D81235056D4FC
SHA-512:	5A45CC644D8D134BA9A54E4BC6459435782E93318754552F44BBAC758348A0D930D55A39F03B8C1152949632E4EBA10D22E31BBBD09D98A292D5083C029A5B62
Malicious:	false
Preview:	2024/09/02-09:30:16.244 1c14 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/09/02-09:30:16.265 1c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.129196377075449
Encrypted:	false
SSDEEP:	6:PpfGVmAEq1wkn23oH+TcwtgUh2gr52KLllpfTq2Pwkn23oH+TcwtgUh2ghZIFUv:Pp6mh1fYeb3hHJLnp7vYfYeb3hHh2FUv
MD5:	CB4DF458D64654A22B9DAB76C2B5B70E
SHA1:	D9032D665E6CFD4284F7DB0C58624F60ADDFF2BF
SHA-256:	C950C80664FA7849FB32ED0ED7E12EE407A3B942B82FCCEBA41A91E4489AAC1A
SHA-512:	AC1741F9BCBDF43C865BA91BB5F82575414E966CDB17B6D0B8AB02531EEC18FC8807586A5EF0A32B2CFE0B6B47463EFA03B7F347766B332959B03BCAA0CF7C9E
Malicious:	false
Preview:	2024/09/02-09:29:58.678 1f40 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/09/02-09:29:58.689 1f40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul65eaKl/l:LszAaq
MD5:	A76E097AD145C444F13ED81517B28413
SHA1:	7E7063BB9B392B9897660A4530DF40059429B319
SHA-256:	6571ADC2351CDE8469BDB96926DD40E4FCC0A57B2541247121735C0EAF10B9E8
SHA-512:	85259138DFB04FE9B2778F113E908182F79855C4291593F265C7AC810586B68DD43DC41E1E87FA0736457D6365D2FB8A49D9CBA6866C92692C3127598B0F1558
Malicious:	false
Preview:	........................................a..8../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:08c9EI03ea+:0A5Q
MD5:	A379B314B38E6D13DB75570305914D38
SHA1:	04328DE8AFE1F0B6CDE0470FA3145DA4BD8D18B8
SHA-256:	CAAD61EDBE26D247100E57F11806FE907CA561EDF94E664E064C6C45191A8D6E
SHA-512:	600A62E47194627AFF001436FF968B229514E29AD11E37946DB7B3329FD876BAD3212C629E46FAA9C959CCF834AE6C10083E5292EB8E553107E9380F7FC5D658
Malicious:	false
Preview:	(....-..oy retne...........................8../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:08c9EI03ea+:0A5Q
MD5:	A379B314B38E6D13DB75570305914D38
SHA1:	04328DE8AFE1F0B6CDE0470FA3145DA4BD8D18B8
SHA-256:	CAAD61EDBE26D247100E57F11806FE907CA561EDF94E664E064C6C45191A8D6E
SHA-512:	600A62E47194627AFF001436FF968B229514E29AD11E37946DB7B3329FD876BAD3212C629E46FAA9C959CCF834AE6C10083E5292EB8E553107E9380F7FC5D658
Malicious:	false
Preview:	(....-..oy retne...........................8../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:C7N00E0Gj:C5g7
MD5:	82753F8009CD63B8AB9F0138243A2A2C
SHA1:	AFFAE8E4E888F597B33F8588AA4D0B443672D69D
SHA-256:	08A380F5A18529251680DD2DA40591ECCBAC69F5B0F994A3BA2FC43BFC840099
SHA-512:	0B426683D8220B45958AB21C41519CB524B209F5742EA772B93E170E74B938F5C7FC8781964522DBDC95541CDC68DAA4C2539F6751BB812236C3DA33613D3CBA
Malicious:	false
Preview:	(....\|.oy retne.........................#.8../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:C7N00E0Gj:C5g7
MD5:	82753F8009CD63B8AB9F0138243A2A2C
SHA1:	AFFAE8E4E888F597B33F8588AA4D0B443672D69D
SHA-256:	08A380F5A18529251680DD2DA40591ECCBAC69F5B0F994A3BA2FC43BFC840099
SHA-512:	0B426683D8220B45958AB21C41519CB524B209F5742EA772B93E170E74B938F5C7FC8781964522DBDC95541CDC68DAA4C2539F6751BB812236C3DA33613D3CBA
Malicious:	false
Preview:	(....\|.oy retne.........................#.8../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlptl:Ls3d
MD5:	9F52C85D9160262076A1266C8B8A7B99
SHA1:	1A030B5B554B6FA24337F526F1224D6EE374E217
SHA-256:	3185C20C6FF298541F009825E10861718AECEBB2CDE2E9C6911CED7FCE9F9891
SHA-512:	0722D9EC6BADEC24438D44B5B743BDF4507B6753E7065E53E607C0B40584796FF5DFE45064DE05FE25D8277DBA1EA98B222770F8415A547E5EA64640F3DC7A6E
Malicious:	false
Preview:	...........................................8../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlhULl:Ls3k
MD5:	5CE9245A72D7DB8E0FC81AB2D2FAF3C2
SHA1:	8330FD0AB2E94CF7A1AFE5218B257EF689365B35
SHA-256:	73704421A27C5C97030160C3FCDD696E534B2AAB2F08171978B527332B7341FA
SHA-512:	BE703EF95EF14206B95025E087DC2F45DB6AAC93A865514B6E95746CC77AFD68C940C9C87A956312FFACF8FBFA5BCACCC73CCF923CB3420E038EE80A4CEF5085
Malicious:	false
Preview:	........................................W.8../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.191822027972875
Encrypted:	false
SSDEEP:	6:PujU+M1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLllhFcyq2Pwkn23oH+Tcwt0jqEKjl:PujU+rfYebqqBvFLnhHvYfYebqqBQFUv
MD5:	ECA4F41520E0B8EFCA489F9E951AF4BB
SHA1:	E6DEFA7D170187C6C9AF7F2E19426FB4592990B2
SHA-256:	13BC05D6B0A849B7E22A13BEA25F92C0B224F0FA22DBC3A93BF4CF57446A0127
SHA-512:	DDEACF5334267CB5AD8DF41021C691D7FA82EE095AC47AA77356669E2BBC03881058DA60DA0D5A6F2777BEC90AF6C5D394CF950EE0439A88C0C07497CDA654AF
Malicious:	false
Preview:	2024/09/02-09:30:00.344 1c14 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/09/02-09:30:00.398 1c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\40541761-dfdd-4cad-9400-a09a862c5fad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\655d5788-f2dd-441f-81b8-605b96c440dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3be6f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f032c527-582c-482a-bf24-ab01d6f4ab16.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ff712f39-a752-4e4a-9af5-0093c7f9bd8e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.209262625330083
Encrypted:	false
SSDEEP:	6:P+V8juM1wkn23oH+Tcwt0jqEKj0QM72KLll+Syq2Pwkn23oH+Tcwt0jqEKj0QMxh:PbjurfYebqqB6LnEvYfYebqqBZFUv
MD5:	1D4943720B2FBFA0DF23DBDA95ABB785
SHA1:	1E039950333C997645684A19DA89B7ADDF71E783
SHA-256:	9C40EC705248DBDAC896AF652D972F83B81152E35EDF12E87C647832BA1BBA10
SHA-512:	00653DD8D11E305B4355D1A17EDC52DE8020713BE2F7D8989C48FFD8CE28FDEBF442F75111B81E96C1B44D834965CB0436DA96D4EBD29285D4068C25B3E4FECD
Malicious:	false
Preview:	2024/09/02-09:30:16.297 1c14 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/09/02-09:30:16.338 1c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.2257458632621585
Encrypted:	false
SSDEEP:	6:PpfEe1wkn23oH+Tcwtkx2KLllpfsIVq2Pwkn23oH+TcwtCIFUv:PpcpfYebkVLnp0IVvYfYebLFUv
MD5:	466065E7D71D02A5760E772DA8371439
SHA1:	4C2CA105670C660F7DEA4FF368C9E14EAAAD1CB6
SHA-256:	E87237DC739F3F65C42D14BC082F9EB476512056D970E7F4EB16EC6453E308A1
SHA-512:	9170D87E20C803E845124F04D2AED6614411C94E1719996C2A11AECF79A2837161B2B8D3E2E21245574D155E35E424E1F072070DC604EAF29BBB7F6B19AE86A4
Malicious:	false
Preview:	2024/09/02-09:29:58.675 1f20 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/09/02-09:29:58.698 1f20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0019698841236789875
Encrypted:	false
SSDEEP:	3:ImtVAj:IiVAj
MD5:	3EF6C3ADDEC22F00B1E75A0AE0E3804B
SHA1:	C433F0839A746AAD034DF917BE99428EF3AE04CC
SHA-256:	A86E12D2612C707836FB466B42871EC881D7E46CF800CD06B39CED29EA8E051A
SHA-512:	68C4CED6E6DC9F8496AE634F570AB23899E4FB6BD4FF8F92DDF4E1EE000AF8664F0CDE8D5E8E59249B41B4996852D12B4F67FCAFE423366154B0857576AA9C08
Malicious:	false
Preview:	VLnk.....?.......D....jS................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0771984186754746
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkO1SAE+WslKOMq+vVumYz9n66:e/2qOB1nxCkO1SAELyKOMq+vVumap
MD5:	827C2A8D9D9914DD2A0E275431059C13
SHA1:	F1A72D73738C45AC1878372E68B15053E4E36C75
SHA-256:	E2AF3E9938E19F4A1B9F920007E67066C0E26BF30796F4C34C3351FCFC291B6B
SHA-512:	F46589358B2FE728CCDB206C7E77DE1ECA4EC970F64342D20C34944123B28DBD9855AF11BE55B597AB8F867469CE1C9A03016E17826AD0567C08422F0A2045E0
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\a1d2e256-d7bc-42a4-bce6-a9cea15f74a0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\a4004c67-08a6-412c-af82-6dfa7a8eb06e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566928415251664
Encrypted:	false
SSDEEP:	768:9TYb38WPoWf0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2/sFWrw+pGtum:9TYb38WPoWf0Tu1jaDUFzbtV
MD5:	05BC31B859DD227B9472C4F5BBF7E993
SHA1:	831E17165E9383B26078C61885A0A2148853C76F
SHA-256:	890CEACC253747C3B1A98161EE0869E5265DB54F6EA7F41A92F32012AD05A8F6
SHA-512:	90DC4A571DC25A9A3131248A1DEA91DA836945D29044B0912270A03DE7F947F80D6CD68C36D2CADCECA89950F6EB38B560213110E4B9F2E278B37410095B7C66
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369757398675182","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369757398675182","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\bdf2f982-512c-4d1b-bb38-74d1a1b6a3a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6426
Entropy (8bit):	4.98021409504811
Encrypted:	false
SSDEEP:	96:stHqfiis1ssb9KRqHN8zmZs85eh6Cb7/x+6MhmuecmAeheQK2M6/EJ:stHEsMqHNkmZs88bV+FiA9P6MJ
MD5:	774C26A47BF25FDF1DDFBCE6064FAC26
SHA1:	253203FE7BAF6238A098023EA360AA2585F99AE7
SHA-256:	978B1EBB44CFD9B5D54B0AB710E066DCE17BB410CBA70182ADF958EDAAC854CB
SHA-512:	5E305009C4057A34F7DD8F7DE900B0C698050A3D344E4E7D8983C0F7CDCFC5B1AEDD7EF9EFAFC4B518671052E55A44F594B3518B71D59DB3CE8498376276134E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369757399233643","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369757400077524"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\df91a0ce-e7ce-4d9c-adce-68b397b93ac1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.972434176303477
Encrypted:	false
SSDEEP:	96:stHqfiis1ssb9KRqHN8zmZs85eh6Cb7/x+6MhmuecmAehNN2M6/EJ:stHEsMqHNkmZs88bV+FiAcP6MJ
MD5:	674AF2C956E15ECE1B98A24442273B80
SHA1:	A406563566B3AC888E38F92D818BEE42AA4A1791
SHA-256:	53373A9FFDAD653C26A0D4AB4A61D0A80DE23145E04BCC24722F2113A6FEB0C9
SHA-512:	109412F221106FFE822E628B31D865FE4CFB4CF58FCD175DD974447748DE77D587459E4F5856E4919E03BDE3A9F7A0BC64B8DC28627A9B8E0530E42D5E5F1BD3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369757399233643","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369757400077524"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\e6ba6f97-9c72-4b58-91a0-142a5dd72a81.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.56679436472592
Encrypted:	false
SSDEEP:	768:9TYb38WPoWfvT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2/sFWrwypGtuv:9TYb38WPoWfvTu1jaDUFz/tk
MD5:	36B2AEAB7D3D828C2713549C771BAA97
SHA1:	3F5E9DBB2FEDC31C08BA29BDDDE5330E97F783DA
SHA-256:	27959F1E58F5B30C82B2A9422E4A24BF74E080B1EEC95EA79F994B497504D4A5
SHA-512:	AE6DE57FFA5E65273ED55A7510ED26032B68B527041E6D7BDEA1DC86BBAC11388A0DEA68B4B273651CFAE29B2BCC6DAE356DAF65AC7FC999F2B7FF324239F674
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369757398675182","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369757398675182","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\f7cd4214-f11b-4f29-aca2-40a9f863869c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/5KllHlFll:7+/l/5+
MD5:	8A5917C8155D12E224A7F447312306FB
SHA1:	EC095B6503497387543B1D1CEFCFDBE6FB3DF312
SHA-256:	2D630254832D82C2866C27F71104F3302A2EDF4A184C5C51F970BA37B71DCA51
SHA-512:	1D4B39A46F5B0C202E7CB2F253E79D0926BEF81125E2BADCB8CCF76840936597F1821A53426183C4FFDB233F2A7B2C92296616EB0B2CA968FE18F3A118678650
Malicious:	false
Preview:	.... .c......VT]................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.05035015541146411
Encrypted:	false
SSDEEP:	6:GLW0/vxxNpW0/vxx1L9X8hslotGLNl0ml/XoQDeX:aDTGEjVl/XoQ
MD5:	E141B4B855ED734B930342C4C95A8177
SHA1:	6CF4753587DC6EFF2CE6C04D45FA8525142468AD
SHA-256:	9B2934FD1B85635D102D2A2090C079E683BDC50E2C74C2E469A4EED78A2DCE80
SHA-512:	09A814B8E1B8B8CEBF95FE48FA0EC4BA5615D9D38D7F8934A28102751DB366592AFCD60F2BD902A8A3E4608B407C4E5F7FF4D3F1E67DD4BD3A7258F23928AC72
Malicious:	false
Preview:	..-......................aXs..Z...br.3..........-......................aXs..Z...br.3................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9975067837032071
Encrypted:	false
SSDEEP:	48:fzxD0lO+NcbX+yyn9VAKAFXX+Rw2VAKAFXX+dyxOqVAKAFXX+AnUYVAKAFXX+pCc:rx8H0NsRcNsd4O5Ns7Nspt
MD5:	ED4CD97E8E6A4873F1C6C32C4A8E7593
SHA1:	B1CF1D8DBE88B1F7DAC8E49E62647A4B3037FC0F
SHA-256:	330A5EB604C2417D307ECB6575A8FC370FB196B991723659097762F4A8ACC140
SHA-512:	8C7AA6DF3860A4294798643F8207779820EA30E429DC301BF77ADF3A442A60473AF44E6BFA4C8F763195759D7E0F81107BD65F92EEEE3FBAAA8B7EE8DF960064
Malicious:	false
Preview:	7....-............br.3..GI.-.............br.3...-..z.fSQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.482103631781827
Encrypted:	false
SSDEEP:	48:zK8tSBS2QoCPEHRHyxQIYjIYqz6qknMYjMYRyBAlkfAlk33UnD:zM02QojIYjIYqz6bnMYjMYWYcY634D
MD5:	7519652ED12C9B0A032CB12471F92B91
SHA1:	C9E51DFD3AF2EE75FBC3F00D9C7D6B0D943A4998
SHA-256:	585E7F736034CBB532A6A5A6B314C75383AABA709586AF898ED8370F390A8944
SHA-512:	29BC44F49EF2F88F2D8B482EE4A37C65B99F35626C994490AE12B2B1873F9CF553E2A768BC992B175AB6A224AFC44581BD200DF28350DCB06BAAD8245AB50607
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.=97.................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4_IPH_De

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.2170712928625935
Encrypted:	false
SSDEEP:	6:PpfrFB1wkn23oH+Tcwt0rl2KLllpfKN+q2Pwkn23oH+Tcwt0rK+IFUv:PpjyfYebeLnpDvYfYeb13FUv
MD5:	FE3E46CFB21F6F29CB93BB2243F95519
SHA1:	C8D97A1083A1E6B8D54E0C0D9D17A2F12EFD8B3E
SHA-256:	A0189CD8B00A1D2DA031D2401781C041A546819EAA169B3D0102D5D9FB16CAD6
SHA-512:	D90B93FFDC3746FB17ADE13B3A4585614FCD5E32DD1A0D70BA85FEA511CD2267EE82AAA909DCBD69A24DD350367765DF5D57E7093F97B046EB1F88FCD682F444
Malicious:	false
Preview:	2024/09/02-09:29:59.927 1ef8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/09/02-09:29:59.940 1ef8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	3.9496800057455608
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/b8gA7QRmSnSedX2Ogp8mvRU0:G0nYUtypD32m3bXESnSotw
MD5:	A618CD56A60FA9D74FA253D3B6D69FBA
SHA1:	C27381BDFBB2E1A4BD11045337271B88E0FE52DC
SHA-256:	214E262F4CC1C997F70AB24BF8A94207F2DC6DAA194E5AEA98174BBBD5ACF393
SHA-512:	BFEF413CFE877436E1308E8A1C8162F7B3563B779A75F0B6F8BBDF47ADFBD3D3BBC933C185CBE92906E1B4BD042A2DCE0C621A604E4DE5D0049E4801CE1745EC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....5oP..................3_.......\4.................4_.....G....................37_.....[Q.\|.................38_.......K..................39_......R...................20_.....m..A.................20_.........................19_......ort.................18_......A@8.................3_......a...................4_......@o..................37_.....n5._.................38_.....LZa..................39_.....D...................9_.....^...................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.190879358904458
Encrypted:	false
SSDEEP:	6:Ppfi3B1wkn23oH+Tcwt0rzs52KLllpfa2+q2Pwkn23oH+Tcwt0rzAdIFUv:Ppq0fYeb99LnpAvYfYebyFUv
MD5:	8629DACCFB368FB89632F0C39516B3CB
SHA1:	779F937FC4E6658C35602AAFE18988E138000BFD
SHA-256:	0C3EB7FF924B80C404AED004D2F0D195E3365FAA70F92D64072D5A53CE4AFE9A
SHA-512:	12220278DB557814A270C1F5B761A7E126DA6E666512484378B709DC9730E5D77E3A1BCE96CCA8D0F6466377B64EF2D3C91E512C9F4A42EB58C94C04BB7AA797
Malicious:	false
Preview:	2024/09/02-09:29:59.258 1ef8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/09/02-09:29:59.923 1ef8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl/4aul:Ls3/q
MD5:	C0DA52F90D9693807315A3EC33CB8DBC
SHA1:	FFE56D2E24763C1A80354B2FC5F29A1425734746
SHA-256:	D2340A18FEFB635E87FCF2791D3B62653631A3771C23DBE21E7C11BAE1A20096
SHA-512:	9118FE83AA767F0CFE89307469109CCE2A38B44DC85881FE0427368318C932B31E8F2C6DDD1EDB95C27A8042DB78D0E4F9C54ED1C1346A1634A1321B3DA96598
Malicious:	false
Preview:	..........................................8../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl3Ll:Ls3B
MD5:	BA767E7E32D5A666DCD603C0FD2A1037
SHA1:	ED30FEB59AFF5A521849658DF065C5950C5724F3
SHA-256:	B3532D2D974B02B217A4D099CD79DDFEF06C21DA452C50AACB86C99FDBB6EA5B
SHA-512:	CBFEA4E5B04BAA943F9CC08363AB17DE0B1109DD5E652356848595A92910947309129EB364E9278C09FF51A6D018C1C3E81EE2BFB803401250250A6D8AB5E8A5
Malicious:	false
Preview:	.........................................'.8../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.538326018914826
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTa7HwF1zBC9QxGTfyikzJdXBuBuwBr48aMNhttZX4CQQRCYfJ:YuBqDPafpcQFukGPegBzBU89nZMB0
MD5:	029F5023F53CD54349BF79BB7A7DA486
SHA1:	D68BC0EBD002D1EDA78F3C2C17CB9AAB69C70BDF
SHA-256:	00EA9878B05EBCC64CD6E631FB83C461EEA719377B79895CC9C3BBA91380C965
SHA-512:	16AC66E21067E336FFE4D58CBC9F07E831D22D7A62D258F23E4D14E17294E2CDDC8A1FCF7E87DBDD66F1DA8CE96C4AC114D944A3210B4DBB1C9530B7F4F796FE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369757397984498","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725283797"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28f74.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.538326018914826
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTa7HwF1zBC9QxGTfyikzJdXBuBuwBr48aMNhttZX4CQQRCYfJ:YuBqDPafpcQFukGPegBzBU89nZMB0
MD5:	029F5023F53CD54349BF79BB7A7DA486
SHA1:	D68BC0EBD002D1EDA78F3C2C17CB9AAB69C70BDF
SHA-256:	00EA9878B05EBCC64CD6E631FB83C461EEA719377B79895CC9C3BBA91380C965
SHA-512:	16AC66E21067E336FFE4D58CBC9F07E831D22D7A62D258F23E4D14E17294E2CDDC8A1FCF7E87DBDD66F1DA8CE96C4AC114D944A3210B4DBB1C9530B7F4F796FE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369757397984498","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725283797"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF29188.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.538326018914826
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTa7HwF1zBC9QxGTfyikzJdXBuBuwBr48aMNhttZX4CQQRCYfJ:YuBqDPafpcQFukGPegBzBU89nZMB0
MD5:	029F5023F53CD54349BF79BB7A7DA486
SHA1:	D68BC0EBD002D1EDA78F3C2C17CB9AAB69C70BDF
SHA-256:	00EA9878B05EBCC64CD6E631FB83C461EEA719377B79895CC9C3BBA91380C965
SHA-512:	16AC66E21067E336FFE4D58CBC9F07E831D22D7A62D258F23E4D14E17294E2CDDC8A1FCF7E87DBDD66F1DA8CE96C4AC114D944A3210B4DBB1C9530B7F4F796FE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369757397984498","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725283797"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF291b7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.538326018914826
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTa7HwF1zBC9QxGTfyikzJdXBuBuwBr48aMNhttZX4CQQRCYfJ:YuBqDPafpcQFukGPegBzBU89nZMB0
MD5:	029F5023F53CD54349BF79BB7A7DA486
SHA1:	D68BC0EBD002D1EDA78F3C2C17CB9AAB69C70BDF
SHA-256:	00EA9878B05EBCC64CD6E631FB83C461EEA719377B79895CC9C3BBA91380C965
SHA-512:	16AC66E21067E336FFE4D58CBC9F07E831D22D7A62D258F23E4D14E17294E2CDDC8A1FCF7E87DBDD66F1DA8CE96C4AC114D944A3210B4DBB1C9530B7F4F796FE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369757397984498","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725283797"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2b8c7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.538326018914826
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTa7HwF1zBC9QxGTfyikzJdXBuBuwBr48aMNhttZX4CQQRCYfJ:YuBqDPafpcQFukGPegBzBU89nZMB0
MD5:	029F5023F53CD54349BF79BB7A7DA486
SHA1:	D68BC0EBD002D1EDA78F3C2C17CB9AAB69C70BDF
SHA-256:	00EA9878B05EBCC64CD6E631FB83C461EEA719377B79895CC9C3BBA91380C965
SHA-512:	16AC66E21067E336FFE4D58CBC9F07E831D22D7A62D258F23E4D14E17294E2CDDC8A1FCF7E87DBDD66F1DA8CE96C4AC114D944A3210B4DBB1C9530B7F4F796FE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369757397984498","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725283797"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2fdbf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.538326018914826
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTa7HwF1zBC9QxGTfyikzJdXBuBuwBr48aMNhttZX4CQQRCYfJ:YuBqDPafpcQFukGPegBzBU89nZMB0
MD5:	029F5023F53CD54349BF79BB7A7DA486
SHA1:	D68BC0EBD002D1EDA78F3C2C17CB9AAB69C70BDF
SHA-256:	00EA9878B05EBCC64CD6E631FB83C461EEA719377B79895CC9C3BBA91380C965
SHA-512:	16AC66E21067E336FFE4D58CBC9F07E831D22D7A62D258F23E4D14E17294E2CDDC8A1FCF7E87DBDD66F1DA8CE96C4AC114D944A3210B4DBB1C9530B7F4F796FE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369757397984498","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725283797"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3545b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.538326018914826
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTa7HwF1zBC9QxGTfyikzJdXBuBuwBr48aMNhttZX4CQQRCYfJ:YuBqDPafpcQFukGPegBzBU89nZMB0
MD5:	029F5023F53CD54349BF79BB7A7DA486
SHA1:	D68BC0EBD002D1EDA78F3C2C17CB9AAB69C70BDF
SHA-256:	00EA9878B05EBCC64CD6E631FB83C461EEA719377B79895CC9C3BBA91380C965
SHA-512:	16AC66E21067E336FFE4D58CBC9F07E831D22D7A62D258F23E4D14E17294E2CDDC8A1FCF7E87DBDD66F1DA8CE96C4AC114D944A3210B4DBB1C9530B7F4F796FE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369757397984498","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725283797"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF37b8a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.538326018914826
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTa7HwF1zBC9QxGTfyikzJdXBuBuwBr48aMNhttZX4CQQRCYfJ:YuBqDPafpcQFukGPegBzBU89nZMB0
MD5:	029F5023F53CD54349BF79BB7A7DA486
SHA1:	D68BC0EBD002D1EDA78F3C2C17CB9AAB69C70BDF
SHA-256:	00EA9878B05EBCC64CD6E631FB83C461EEA719377B79895CC9C3BBA91380C965
SHA-512:	16AC66E21067E336FFE4D58CBC9F07E831D22D7A62D258F23E4D14E17294E2CDDC8A1FCF7E87DBDD66F1DA8CE96C4AC114D944A3210B4DBB1C9530B7F4F796FE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369757397984498","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725283797"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3a2b9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.538326018914826
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTa7HwF1zBC9QxGTfyikzJdXBuBuwBr48aMNhttZX4CQQRCYfJ:YuBqDPafpcQFukGPegBzBU89nZMB0
MD5:	029F5023F53CD54349BF79BB7A7DA486
SHA1:	D68BC0EBD002D1EDA78F3C2C17CB9AAB69C70BDF
SHA-256:	00EA9878B05EBCC64CD6E631FB83C461EEA719377B79895CC9C3BBA91380C965
SHA-512:	16AC66E21067E336FFE4D58CBC9F07E831D22D7A62D258F23E4D14E17294E2CDDC8A1FCF7E87DBDD66F1DA8CE96C4AC114D944A3210B4DBB1C9530B7F4F796FE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369757397984498","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725283797"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF40154.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.538326018914826
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtTa7HwF1zBC9QxGTfyikzJdXBuBuwBr48aMNhttZX4CQQRCYfJ:YuBqDPafpcQFukGPegBzBU89nZMB0
MD5:	029F5023F53CD54349BF79BB7A7DA486
SHA1:	D68BC0EBD002D1EDA78F3C2C17CB9AAB69C70BDF
SHA-256:	00EA9878B05EBCC64CD6E631FB83C461EEA719377B79895CC9C3BBA91380C965
SHA-512:	16AC66E21067E336FFE4D58CBC9F07E831D22D7A62D258F23E4D14E17294E2CDDC8A1FCF7E87DBDD66F1DA8CE96C4AC114D944A3210B4DBB1C9530B7F4F796FE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"profile":{"info_cache":{},"profile_counts_reported":"13369757397984498","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725283797"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlppll:Ls3r/
MD5:	D692E14362F1A1B054559ABC64BD814A
SHA1:	47E8F024E4687DC6DEF4D8B3B7A4EAEDCA8F9B53
SHA-256:	3C380C1A0AA77C779397F89E8442D2D4FB9C1019B377936E5A128EFEA1761140
SHA-512:	D34D3F1989974FF101A54FDFD0CA226AECC83211C333EE93F904EF161D8FEB3AF87588C4D97E8B6CD024257B8146DB5EEACB648720055D7357F0CCA5F518927A
Malicious:	false
Preview:	.........................................q8../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ebfcf521-05d0-463d-9b0f-2db7ab60dad6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.6089890298629514
Encrypted:	false
SSDEEP:	96:0q8NkC1fpcQEFFl/Bqava8FUaJkncLSDS4S4SDSJI4a:/8NbbcQE3fUWkn6
MD5:	F81B5EFE4E75E57B2FB40817305D6B98
SHA1:	366FD1D15EA41BA25A84F8497083BB13164D5738
SHA-256:	A94E6BA2A6A00913C2BA9BF7877D6318C48BDF2CCA9FB13C25340F6F219232FC
SHA-512:	EEEC29E17DEE39B5CF1A515C59C53F77C9C779BB620454DB8F46E33C2777D29D91ECA523596DF32694A75A9918AD6EAA9C246DF55C9F3B95B964C03817D2C6B1
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAFHEl5dJ/hcKc5JUmBs4D27dAd8vjcgm1+7jgGWzZjVQAAAAAOgAAAAAIAACAAAAC0ArLq0ChcC/fNLaWlBoydXtx1+rvjmm6PdebQwMTbeDAAAAA/4HCbN09FLkP1S+P7vcbOe0F2JMpiPok9lj9OUmRJrPHcv6Q+0XGDvTaxtLszs1dAAAAAJ7EIdfDtp1GIzz38Dmy1xioy1lYOBCAzWI9UX25Y0JeRudqZYpL5EG+9fpxlnkDFGzg/Exrv3Wo0DE9WmSFhYA=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\fc49a355-393c-47fd-875a-82ba4298baf2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24342
Entropy (8bit):	6.054098909600444
Encrypted:	false
SSDEEP:	384:qtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NGyvlsN90LqdqVETyoHpV1PdQYT3W4AdP:OMGQ7FCYXGIgtDAWtJ4nMvq30Y2QpV1K
MD5:	412626237872C5C3FA7E629171EB8BBC
SHA1:	2B3255FDE2D3A4CBD16ECCD404B92F24FD82C33D
SHA-256:	93F64AE122D3ED6FA4A7B4BC049311B34EBD0F4C849B13F6F9AB690F6D20FD30
SHA-512:	6766A0A0F3B6719E8DBB3A3EC3BA5120F56FC24773F7045315CBBF741C5FCAE95B43D5380FDA1B1C94D966F1E33DC9722B6B3A8DC903DB3D65DC18DDBAC230D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369757400123830","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\23103ed2-d00f-4624-a9c6-26cf96568458.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.8330831451837835
Encrypted:	false
SSDEEP:	192:fsNwRca3ojeiRUfm14Q5wxyzknE96qRAq1k8SPxVLZ7VTiB:fsNwRT3QSOf5w0wnE96q3QxVNZTiB
MD5:	D1012DDDB80EF91250EB6EA7329D4961
SHA1:	A69F3722EC1B02955173308417259D0A7B566C86
SHA-256:	563AB40BE1B28580D74A04E7ABFC288E4317EBCA58D0072A92BB3AD0C3038A0F
SHA-512:	F2FF526118C80A2316DB64AB06D8E7EC53DF1621920818ADB9C53845E95C9E057A5563DABC6B878AEA771CAFC449A09F438E150A7BD33DF4D54E5DDB8203A69E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9bb3be02-9133-4ec0-a61a-ccfaaa18339f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24685
Entropy (8bit):	6.053611907844005
Encrypted:	false
SSDEEP:	768:aMGQ7FCYXGIgtDAWtJ4n5t20azXth02tdi:aMGQ5XMBG59azfK
MD5:	20ADA4B1A12937D65214C6334DA47336
SHA1:	00D73CF9B7D67855A2E61724806CA6BFAD58848E
SHA-256:	D458AB5BB03693D7D11399BB29CC2871092BD370C4C6FC6CE2BA10529C42EA3C
SHA-512:	DA21D7B468A041FDD03EA5005E8B8CE93EC542766D3788E66A56B0DCAFFB5BE3DCE5BD140FC061CC07B60BA08C46DA9D80E976E248DE633C7513A7AE145CF6B8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369757416992547","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\648c860b-cc49-44cb-8c16-b528035288c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D5BDE8-21B0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.310856398701042
Encrypted:	false
SSDEEP:	3072:pOWvGdXoh+WUSoMYgzZRuFikJ7SmLoMVFjQCZhbQczRYkNeI/Jshqt1+tf2AzPpX:dQAWiWSpMVF5YsqyeQaHZLN
MD5:	D52770887B13BDEADD0DD49A8661417D
SHA1:	670BB5C6288517A303A314EA74C81B023CA316A8
SHA-256:	12F9406FB7FDB7CEE7D0C73052569CC5B341883BA64AB697316EDBBB26491EDA
SHA-512:	783601D9B49E78B93ECD33091CCF983B81826E2BF467996B5CDD9C1E1C8ED6BFFB2E6B7D2412D9BF3B7ED657D1394DBBEC1C83BBAB8DBB06F5239A55870F0DA5
Malicious:	false
Preview:	...@..@...@.....C.].....@................N..(N..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".cpbqix20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D5BDF0-26C4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03938931234470213
Encrypted:	false
SSDEEP:	192:Lv0EbtmqvDMKXhJLMo40pNgMXHrA0knzYhQANoEROI1gQsk0bFq9n8y08Tcm2RGY:b0EtD4oi14h5q7ggA0hq08T2RGOD
MD5:	1F696985B6A9792148412FBC691CEAC4
SHA1:	21FD389F27C80FAE0A1F51BDAAE54B75295020AF
SHA-256:	E1A7E9094AB21DB31D4A4828A910D26CDA5DC5DBC3E78CB29F06D3FEDE6560F8
SHA-512:	9C5CCED5700EBBE944A455769BB0C2092C69ABF7C8EDE2817A0F277CBB614F1A3C42A68DE5EF6044113F2ACA13F869AE211991F4FE7143192849E162AB430F34
Malicious:	false
Preview:	...@..@...@.....C.].....@................_..XO..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".cpbqix20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D5BDF9-2034.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03850576534659264
Encrypted:	false
SSDEEP:	192:LW0EbtmqvDKKX2JLMo4sI4XaZgLE6hkgNEFy6v21gQMaG/9jf9qFn8y08Tcm2RGY:q0Etq4hEPhFkSg2GN9S08T2RGOD
MD5:	F1DB64F986183E57FA5A7BCAC8A4E31C
SHA1:	A139AF06E86F4C62DB0FC495FC542D57CD3EE115
SHA-256:	B9A1B6CA8AA65B3C5D69BE2221CAAE413FAC0362844EAD74654555FE7680FD23
SHA-512:	F12CBFF4C44D07A2CB1CCC9EB61CB0DB8D4BA73EB1A691511BDC912CE1D5251ED6673C74E95F2AF7E163C9559EC9B7CB37B5802515CD915147FEDD9E611961E1
Malicious:	false
Preview:	...@..@...@.....C.].....@................]..`M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".cpbqix20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D5BE06-2190.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03877902152096
Encrypted:	false
SSDEEP:	192:7B0EbtmqvD3KX7BJEa3Xxx7UpXxgg6zfhj1NErZGtM1gQM8eO7Mqln8y08Tcm2Rl:V0EtYeZVQh5WWsgAeVS08T2RGOD
MD5:	04A747731B6375C03C0C95E04314120C
SHA1:	BCBE98435316E8964FA87DD36A2DA635A5B6352D
SHA-256:	16D096D8196DE679C624B3DFED9C5F4FA7198503F78D8FF9390BF74F7376D20E
SHA-512:	4006D1C7C30C7D14B455103758355849D0D23245E83380AB8762D1D3AA14A093B56D430BD8B25F77D3A1B590ABD4BEEF3AF6C5F76AAD6A3E330F77D976DB8F3E
Malicious:	false
Preview:	...@..@...@.....C.].....@................\..PL..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".cpbqix20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\38b77079-d972-4cc2-8dcd-a8ec00d44a69.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558245325658569
Encrypted:	false
SSDEEP:	768:r9GtK37pLGLv8ZWPAefLO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU5JlprwKZpztuf:r9GtKxcv8ZWPAefLOu1jat7laUtM
MD5:	4CB244D6459DCE1FFAB60D7041691954
SHA1:	0D6C7FCD55AF65C5F9CD1E23D632A72FB8D13D59
SHA-256:	6CF7A88493C0D4A8658A194A61049DB0743EBB650C5882C49D84F424F6908CB0
SHA-512:	63C3F51C12BFF768FA23D5299E428B799B4DF905FC12C5A72C0D7DE52FE1C7D9683C36915D9F2114B6A34F6A2A897FE15F60B77A44E143F77F53F201920DB753
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369757416713506","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369757416713506","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\438b1f2b-b09d-47f4-ba74-d37ea8ef8d30.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.566265340686673
Encrypted:	false
SSDEEP:	768:r9GtK37pLGLv8ZWPAefMO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfo75Jlprwoupz0:r9GtKxcv8ZWPAefMOu1jaqo77laDtG
MD5:	3A568F29DC92D3006B2BA2A32EB08586
SHA1:	F3ACE903C832DD206D8A5B6A5998D1766169CA1B
SHA-256:	25BD81E7DA0BC3AD0E9079F18CCE71AF5610D9A7ED12A2B9D8369F548F2479E8
SHA-512:	B35B477B0846D60D70BE7FF034C3EE256A7CE222A7C3730CD4112ACFC1AC800CC7DAB6300A4AC8B347DBFCF2F548E62B8696A2807A3596D7E604D302416803C2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369757416713506","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369757416713506","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8e368928-2d5c-4078-a6e0-1ace8927080e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.070705747417926
Encrypted:	false
SSDEEP:	96:sVAlqltJ1mb9uRHxXC1z6Y4sY5Th6Cp9/x+6M8muecmAeCje4zvr82X6gE5AtEHb:sVAlSJxHxMmY4sYPpj+FVAv8FBf
MD5:	CEEDDAC21CAEA133185A85CB8BED4E35
SHA1:	B988B63105BCEA546D2F38A426E7AEBD0F008E16
SHA-256:	9F3B1364D19BDDF2AEAA4EB31EBDD26CFCC81AB93EB13A095B0F97F9A027784D
SHA-512:	EB8D2E376E2C40C41A7B464FFBD08FD4571B951A9DE74AFB3965734B36B49AF80F51B87E8563368A1FAAF8F2862C7A0B7104079CA20FD93C3F8E5562CC91359F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369757416961732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8e6cd7c3-7cdf-48f2-ad9b-534d8674b89e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.189829821361452
Encrypted:	false
SSDEEP:	96:sVAlqltJ1mb9uRHxXC1zYhdH5FUY4sY5Th6Cp9/x+6M8muecmAeCtue4zvr82X6p:sVAlSJxHxMol5FUY4sYPpj+FVAS8FBf
MD5:	46DDCA6FF1A9A789F421BDB1472F1362
SHA1:	3958295EE22B95DFF3B2157F0EFC65780FE9C76A
SHA-256:	A423240BE450E956A41ACDB4D7C6FF1DD45751E4D23F2DBD7BD96BA9D738B36E
SHA-512:	0E371DD665234855F469BD61DC4F29EBF4E7A7DF1D96181B63EF570F68E52FB3FF40DDE20329B4414B1CCC535878C16DAEABE688168478D7F149E2312C0BD464
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369757416961732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321806673065894
Encrypted:	false
SSDEEP:	192:EAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:3OEOKSXs/J7mGnQmLu5/5eNdl
MD5:	0AF0680D04C9EA62336E8CE4E07DA3DF
SHA1:	0F1E751283322FFC38F3F87C8C9459EE02E65325
SHA-256:	C4E7B1FF53D7AAE05492C21B024231911F2C3453904D4E7453181EBF30873C87
SHA-512:	5727D0527DFA9FF942F87FD08E4D9ED5F6D9C06CDB10AAC2071E2E4945F5AA8A17B61837D4A235F2EBBE3D02AC59D9E9E26B83D7FFEA178A9F8C7483F90393C6
Malicious:	false
Preview:	...m.................DB_VERSION.1....................QUERY_TIMESTAMP:arbitration_priority_list4...13369757420163946.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.0950168007199155
Encrypted:	false
SSDEEP:	6:Pw0Fds1wkn23oH+Tcwt9Eh1ZB2KLllvH9+q2Pwkn23oH+Tcwt9Eh1tIFUv:Pw0FdLfYeb9Eh1ZFLnP9+vYfYeb9Eh1b
MD5:	B018A4B9EBB92FD8C6FE08CC01016489
SHA1:	1B7C88EE0C229F582826D107E5BF55E803930356
SHA-256:	B31879B0272115292A1BB01BBF9E3A2E39BAD5B9C2FF471399F4E70637926B7C
SHA-512:	06C84587266C54B4A54459719FAF3BCE3106E584D2FD362451E75665CF16229143013D1E904931E0D7AB9113BF7D2B77A3B90EC1D9CA5514D9DA5C1F014164D5
Malicious:	false
Preview:	2024/09/02-09:30:18.984 235c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/09/02-09:30:19.205 235c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlP6t:Ls3yt
MD5:	0C09B3A794DB15F1073C035E9B252854
SHA1:	5919571DE8DF8B79BCC1702B68E38C5E04E4670E
SHA-256:	A2C0168625434F38D48B276399B2C98CC34F34E6830EB519000C9348E97021EC
SHA-512:	9CCA1D5A187BC07757A7129DFEA1273152F03E6A902EB04AF6DE8B88D1D127D04E3825101EB98EA1D594C2C134978D3F5E4B6BEB3770A25F8A4740B329C53C67
Malicious:	false
Preview:	........................................ ..9../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.194310297439236
Encrypted:	false
SSDEEP:	6:P+RZds1wkn23oH+TcwtnG2tbB2KLll+P9+q2Pwkn23oH+TcwtnG2tMsIFUv:PWZdLfYebn9VFLnm+vYfYebn9GFUv
MD5:	C6D2522C6BAE000A1B2FAEB36DE774F8
SHA1:	1BBFC23329CD4230078E8306BD644F0BFC806556
SHA-256:	EF649D472FBF3E90FA1DE4D9E6BEF7388E18F6DFD92B8C43FB2D26CFE74E537F
SHA-512:	B3C75BCF312EE5DD3A3E281134857ADE68BE73FD8EA13AD684FBF50DAF45AC0DA38E6E5E43564C369A4315D1B33295FCE96A811E91A21DD432FA190E6B580236
Malicious:	false
Preview:	2024/09/02-09:30:16.712 1ebc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/09/02-09:30:16.807 1ebc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.16564224533074
Encrypted:	false
SSDEEP:	6:P+tyoM1wkn23oH+Tcwt8aVdg2KLllP0yq2Pwkn23oH+Tcwt8aPrqIFUv:PutrfYeb0LnxvYfYebL3FUv
MD5:	5F0ADDF7D00C70F67EBD810F163B1349
SHA1:	634115BED4A4CF972B2EE5AE37B8E6058E3016BF
SHA-256:	6B0E07E60FC985C0D724571EE2E30AB5B145CE4DFDE06664BD5652B902E3D8C1
SHA-512:	57BE654118CF7954F0C1F637E45A5CED1220CF681A2A5E3FB0D2B30D8200D8D69BFF7AE97D204973CAA2BB35962BBD46714B6C9E31E82FF18693CFCC1AFA709D
Malicious:	false
Preview:	2024/09/02-09:30:16.837 1e94 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/09/02-09:30:17.622 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.15952187205965
Encrypted:	false
SSDEEP:	6:PP9M1wkn23oH+Tcwt86FB2KLllPdyq2Pwkn23oH+Tcwt865IFUv:PVrfYeb/FFLnovYfYeb/WFUv
MD5:	8E2DE345AABA68FE50800E9A94D2D9E1
SHA1:	384710775FB484C40254CEB11952BADF9156D0D3
SHA-256:	7915B46E9BF046638E660049A21029F3ED59331FEC9C7CA96556BCD0698BFDB4
SHA-512:	15DDADE484F162D98E3F8C4315548A555BC3D860CA4A197D56ECB399374610239DC588D67F90EAB88B35429772448C88ED6D86E06E05E6680E6BC77F955775FC
Malicious:	false
Preview:	2024/09/02-09:30:17.628 1e94 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/09/02-09:30:17.643 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.161358167852233
Encrypted:	false
SSDEEP:	6:P7Qayq2Pwkn23oH+Tcwt8NIFUt827Ez1Zmw+27ElRkwOwkn23oH+Tcwt8+eLJ:P7Q/vYfYebpFUt827Ez1/+27Ez5JfYey
MD5:	BB6A20910B744548BF6BA5D0D9766A6B
SHA1:	F6AC2F7AABAAA8352D6AEBE69FF206BF86B89F5A
SHA-256:	9DD0A9D28C935DEB569E7F2EA70B8B954B7BC95D53E10735AE59C069CAA3E63A
SHA-512:	1459BFBEAEF09D558F7AFA3726EFE43D8C614B7973F2EF29A55954A7A0F6F973908F966BF6164C633493455699F8F34110A962307B28738953F51BE7A9ADF9A8
Malicious:	false
Preview:	2024/09/02-09:30:17.715 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/02-09:30:17.716 1e94 Recovering log #3.2024/09/02-09:30:17.716 1e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.161358167852233
Encrypted:	false
SSDEEP:	6:P7Qayq2Pwkn23oH+Tcwt8NIFUt827Ez1Zmw+27ElRkwOwkn23oH+Tcwt8+eLJ:P7Q/vYfYebpFUt827Ez1/+27Ez5JfYey
MD5:	BB6A20910B744548BF6BA5D0D9766A6B
SHA1:	F6AC2F7AABAAA8352D6AEBE69FF206BF86B89F5A
SHA-256:	9DD0A9D28C935DEB569E7F2EA70B8B954B7BC95D53E10735AE59C069CAA3E63A
SHA-512:	1459BFBEAEF09D558F7AFA3726EFE43D8C614B7973F2EF29A55954A7A0F6F973908F966BF6164C633493455699F8F34110A962307B28738953F51BE7A9ADF9A8
Malicious:	false
Preview:	2024/09/02-09:30:17.715 1e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/02-09:30:17.716 1e94 Recovering log #3.2024/09/02-09:30:17.716 1e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.32872990409968056
Encrypted:	false
SSDEEP:	6:PwHA/J3+t76Y4QZZofU99pO0BYRbqR4EZY4QZvG9:LhHQws9LdRBQZG9
MD5:	93C9F5098EBBBE16C9D16B054CF8E8A0
SHA1:	E3005C6C685852D81DFB10245735E7D053AAE61E
SHA-256:	AA0FB8598BDF5B9EA52C717452C248C7497311AFEF63A70089C59FA59DF6ADD6
SHA-512:	704967939B3EC50B038F31501C51D45E3DEBAA1D6C8EAB9C274DB9945F9184B74130E731248FF534B8B1773ADDFDF4058E2893343F54A240F074924FAD90FD46
Malicious:	false
Preview:	.............{8....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.270667501382804
Encrypted:	false
SSDEEP:	12:Pw3QvYfYeb8rcHEZrELFUt82w+/+2wy5JfYeb8rcHEZrEZSJ:Y3iYfYeb8nZrExg8Nt8JfYeb8nZrEZe
MD5:	2F389FD89B26322D73E0807146E83CEC
SHA1:	5C6964A6B3F375697622B1B6D9A4CDD22A56180B
SHA-256:	D47252356195DA504EB37E731444888CAC1597378276E5785E3CFDCB873C391F
SHA-512:	0E5E75E91129B1C9BE73F8AEEA91A277B70F78E77584E1D02A6B81BA81728DD2532E082B7DA3C04724AB80306ABD15B8CD78FDF3B6AB615BB4E9BAB0C16356A0
Malicious:	false
Preview:	2024/09/02-09:30:18.196 1e48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/02-09:30:18.197 1e48 Recovering log #3.2024/09/02-09:30:18.197 1e48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.270667501382804
Encrypted:	false
SSDEEP:	12:Pw3QvYfYeb8rcHEZrELFUt82w+/+2wy5JfYeb8rcHEZrEZSJ:Y3iYfYeb8nZrExg8Nt8JfYeb8nZrEZe
MD5:	2F389FD89B26322D73E0807146E83CEC
SHA1:	5C6964A6B3F375697622B1B6D9A4CDD22A56180B
SHA-256:	D47252356195DA504EB37E731444888CAC1597378276E5785E3CFDCB873C391F
SHA-512:	0E5E75E91129B1C9BE73F8AEEA91A277B70F78E77584E1D02A6B81BA81728DD2532E082B7DA3C04724AB80306ABD15B8CD78FDF3B6AB615BB4E9BAB0C16356A0
Malicious:	false
Preview:	2024/09/02-09:30:18.196 1e48 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/02-09:30:18.197 1e48 Recovering log #3.2024/09/02-09:30:18.197 1e48 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.116667059202015
Encrypted:	false
SSDEEP:	6:Pwh5Oq2Pwkn23oH+Tcwt8a2jMGIFUt82whS0wZZmw+2whcZgzkwOwkn23oH+Tcw2:PwrOvYfYeb8EFUt82wPc/+2wKqz5JfYL
MD5:	B107E4328C4C139A48233006128130E5
SHA1:	4C0AFDD7EBC37C0D0F4695D5596304DED54988E8
SHA-256:	0BB6EEBC8E06A681D51757369FD02046735E890AE496D65BE77046B5AF35C343
SHA-512:	319E8AE124E92B7A32A94D787841418FB7642DCDD1EC76C67CE1C397A3EEBEBE27302169ED6B3F30981DD543E135629E192FFE2244F216072DEF6B843AC5BFE2
Malicious:	false
Preview:	2024/09/02-09:30:18.063 2320 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/02-09:30:18.079 2320 Recovering log #3.2024/09/02-09:30:18.096 2320 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.116667059202015
Encrypted:	false
SSDEEP:	6:Pwh5Oq2Pwkn23oH+Tcwt8a2jMGIFUt82whS0wZZmw+2whcZgzkwOwkn23oH+Tcw2:PwrOvYfYeb8EFUt82wPc/+2wKqz5JfYL
MD5:	B107E4328C4C139A48233006128130E5
SHA1:	4C0AFDD7EBC37C0D0F4695D5596304DED54988E8
SHA-256:	0BB6EEBC8E06A681D51757369FD02046735E890AE496D65BE77046B5AF35C343
SHA-512:	319E8AE124E92B7A32A94D787841418FB7642DCDD1EC76C67CE1C397A3EEBEBE27302169ED6B3F30981DD543E135629E192FFE2244F216072DEF6B843AC5BFE2
Malicious:	false
Preview:	2024/09/02-09:30:18.063 2320 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/02-09:30:18.079 2320 Recovering log #3.2024/09/02-09:30:18.096 2320 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\18946671-25fb-486a-9f38-64204969feff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\49bb30ec-cb2d-4116-bb0a-dcf9226147e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\594d39f7-f8b0-4895-9ad2-7f55e20ebf0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6cdace7c-e1d4-4ac4-8396-8ec55fb7d2aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7934cda1-aed6-4925-9668-4a6f6f9d63d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.292075925421477
Encrypted:	false
SSDEEP:	24:YXs9/ZVMdBs9NZFRudFGcs9LnZFGJ/dbG7nby:YXs9h8s9Lfcds9LZgzbZ
MD5:	D0953C208871B8E84C148CDE26EB8F22
SHA1:	417FFC031396C42046D5F1F3F353A4076572770B
SHA-256:	6782453EF65DBACBFFABE53F09FB1BFC28962F90E48BC06AF210949ED27D71AA
SHA-512:	9C5C028615A3D0C927FC08AA68D12EEB197664FBFC9D63C62C72B358B68EA38F94D1844023F66CD6563469E1B71CB4C346E74DF349796789437D6F3A2121D362
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372349419407141","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372349420454240","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372349423995898","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF307c1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3f3e6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2e0ff.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2ee2e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF307c1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d8ca89a9-7098-4e0b-a595-1bed8088812e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e906617e-3fb5-4f2c-aa77-2524d93b86ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.070705747417926
Encrypted:	false
SSDEEP:	96:sVAlqltJ1mb9uRHxXC1z6Y4sY5Th6Cp9/x+6M8muecmAeCje4zvr82X6gE5AtEHb:sVAlSJxHxMmY4sYPpj+FVAv8FBf
MD5:	CEEDDAC21CAEA133185A85CB8BED4E35
SHA1:	B988B63105BCEA546D2F38A426E7AEBD0F008E16
SHA-256:	9F3B1364D19BDDF2AEAA4EB31EBDD26CFCC81AB93EB13A095B0F97F9A027784D
SHA-512:	EB8D2E376E2C40C41A7B464FFBD08FD4571B951A9DE74AFB3965734B36B49AF80F51B87E8563368A1FAAF8F2862C7A0B7104079CA20FD93C3F8E5562CC91359F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369757416961732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF35bcd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.070705747417926
Encrypted:	false
SSDEEP:	96:sVAlqltJ1mb9uRHxXC1z6Y4sY5Th6Cp9/x+6M8muecmAeCje4zvr82X6gE5AtEHb:sVAlSJxHxMmY4sYPpj+FVAv8FBf
MD5:	CEEDDAC21CAEA133185A85CB8BED4E35
SHA1:	B988B63105BCEA546D2F38A426E7AEBD0F008E16
SHA-256:	9F3B1364D19BDDF2AEAA4EB31EBDD26CFCC81AB93EB13A095B0F97F9A027784D
SHA-512:	EB8D2E376E2C40C41A7B464FFBD08FD4571B951A9DE74AFB3965734B36B49AF80F51B87E8563368A1FAAF8F2862C7A0B7104079CA20FD93C3F8E5562CC91359F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369757416961732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e948.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.070705747417926
Encrypted:	false
SSDEEP:	96:sVAlqltJ1mb9uRHxXC1z6Y4sY5Th6Cp9/x+6M8muecmAeCje4zvr82X6gE5AtEHb:sVAlSJxHxMmY4sYPpj+FVAv8FBf
MD5:	CEEDDAC21CAEA133185A85CB8BED4E35
SHA1:	B988B63105BCEA546D2F38A426E7AEBD0F008E16
SHA-256:	9F3B1364D19BDDF2AEAA4EB31EBDD26CFCC81AB93EB13A095B0F97F9A027784D
SHA-512:	EB8D2E376E2C40C41A7B464FFBD08FD4571B951A9DE74AFB3965734B36B49AF80F51B87E8563368A1FAAF8F2862C7A0B7104079CA20FD93C3F8E5562CC91359F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369757416961732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558245325658569
Encrypted:	false
SSDEEP:	768:r9GtK37pLGLv8ZWPAefLO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU5JlprwKZpztuf:r9GtKxcv8ZWPAefLOu1jat7laUtM
MD5:	4CB244D6459DCE1FFAB60D7041691954
SHA1:	0D6C7FCD55AF65C5F9CD1E23D632A72FB8D13D59
SHA-256:	6CF7A88493C0D4A8658A194A61049DB0743EBB650C5882C49D84F424F6908CB0
SHA-512:	63C3F51C12BFF768FA23D5299E428B799B4DF905FC12C5A72C0D7DE52FE1C7D9683C36915D9F2114B6A34F6A2A897FE15F60B77A44E143F77F53F201920DB753
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369757416713506","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369757416713506","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF34046.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.558245325658569
Encrypted:	false
SSDEEP:	768:r9GtK37pLGLv8ZWPAefLO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU5JlprwKZpztuf:r9GtKxcv8ZWPAefLOu1jat7laUtM
MD5:	4CB244D6459DCE1FFAB60D7041691954
SHA1:	0D6C7FCD55AF65C5F9CD1E23D632A72FB8D13D59
SHA-256:	6CF7A88493C0D4A8658A194A61049DB0743EBB650C5882C49D84F424F6908CB0
SHA-512:	63C3F51C12BFF768FA23D5299E428B799B4DF905FC12C5A72C0D7DE52FE1C7D9683C36915D9F2114B6A34F6A2A897FE15F60B77A44E143F77F53F201920DB753
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369757416713506","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369757416713506","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.038945797104055
Encrypted:	false
SSDEEP:	6:PGq2Pwkn23oH+TcwtrQMxIFUt82ChZmw+2gzkwOwkn23oH+TcwtrQMFLJ:PGvYfYebCFUt82Ch/+2gz5JfYebtJ
MD5:	A7F5BD8484808CDA6F5412CE436B424D
SHA1:	FA41291831551859BC0A7F4507923428B9B180B7
SHA-256:	4F31C8398CE5407CA25040D1ABC8C674435056A685790679F2D514711A1E64F2
SHA-512:	D947DF4C38B84B2689AA6E3D6974788E3DCCCA27B0D0F8382E19A2B509C5DC3AC0B3FACB8C1D173ED52024156FEACEA0296171E88761A137F308F125F8B2A231
Malicious:	false
Preview:	2024/09/02-09:30:33.281 2320 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/02-09:30:33.282 2320 Recovering log #3.2024/09/02-09:30:33.284 2320 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.038945797104055
Encrypted:	false
SSDEEP:	6:PGq2Pwkn23oH+TcwtrQMxIFUt82ChZmw+2gzkwOwkn23oH+TcwtrQMFLJ:PGvYfYebCFUt82Ch/+2gz5JfYebtJ
MD5:	A7F5BD8484808CDA6F5412CE436B424D
SHA1:	FA41291831551859BC0A7F4507923428B9B180B7
SHA-256:	4F31C8398CE5407CA25040D1ABC8C674435056A685790679F2D514711A1E64F2
SHA-512:	D947DF4C38B84B2689AA6E3D6974788E3DCCCA27B0D0F8382E19A2B509C5DC3AC0B3FACB8C1D173ED52024156FEACEA0296171E88761A137F308F125F8B2A231
Malicious:	false
Preview:	2024/09/02-09:30:33.281 2320 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/02-09:30:33.282 2320 Recovering log #3.2024/09/02-09:30:33.284 2320 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.120488397616224
Encrypted:	false
SSDEEP:	6:P+K9Q+q2Pwkn23oH+Tcwt7Uh2ghZIFUt82+KtZgZmw+2+KtZQVkwOwkn23oH+Tcz:PvQ+vYfYebIhHh2FUt82vZg/+2vZQV5K
MD5:	8B5365A22321C5DD24FAC7564E5DC8D5
SHA1:	FC7E2F73BD13624EAEDDF8617B1B231FA3D58F53
SHA-256:	BC4E846789B8206CF2E27CC23725C88310D81F728CED2131BEBAB239902969E9
SHA-512:	F25FDCD22CF4ACB4AEA338FCEC10C2245D7C2164FA4C8C552822AE30F7327B09E722156C67D99864C8E5F5590947E71741E4576BD497D125BE154F0968C45DEA
Malicious:	false
Preview:	2024/09/02-09:30:16.927 1e7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/02-09:30:16.929 1e7c Recovering log #3.2024/09/02-09:30:16.929 1e7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.120488397616224
Encrypted:	false
SSDEEP:	6:P+K9Q+q2Pwkn23oH+Tcwt7Uh2ghZIFUt82+KtZgZmw+2+KtZQVkwOwkn23oH+Tcz:PvQ+vYfYebIhHh2FUt82vZg/+2vZQV5K
MD5:	8B5365A22321C5DD24FAC7564E5DC8D5
SHA1:	FC7E2F73BD13624EAEDDF8617B1B231FA3D58F53
SHA-256:	BC4E846789B8206CF2E27CC23725C88310D81F728CED2131BEBAB239902969E9
SHA-512:	F25FDCD22CF4ACB4AEA338FCEC10C2245D7C2164FA4C8C552822AE30F7327B09E722156C67D99864C8E5F5590947E71741E4576BD497D125BE154F0968C45DEA
Malicious:	false
Preview:	2024/09/02-09:30:16.927 1e7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/02-09:30:16.929 1e7c Recovering log #3.2024/09/02-09:30:16.929 1e7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul1O/:LsD
MD5:	1EFC271114321397C587C81D6D9B19DB
SHA1:	C716A537867F6BB0255F9D0AF204B759A5948EB2
SHA-256:	776399A5622E5E9999B121828A31197F6896773A6691114C1E306A8550DFE576
SHA-512:	C47D2C67DCFEFD6281D69AA2BFA065AFBC0C6192F1BF42E25B3B750961B58199684712130602C127608E48201560610E4F1C87777902050124724CF7D50B2940
Malicious:	false
Preview:	.........................................b.9../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl7v/:Ls3r
MD5:	F099D06ADC1A60ADE8BC037A1F2C3FE9
SHA1:	4ADD62F0705CDC0B875638C1F239BE683B4E2A0D
SHA-256:	6F872A48CE6409F6C338BE896CE1E7F20A11077BFFBC67FD252CF2C756E1F541
SHA-512:	4D9074CC6EB4948A56B60422DB0025A21C113078D509DF28A0173EAE0A3BC5C95FD4C6C1687C17A9818E348744B618D4A6230F827428F559BF58CD965EED4AF5
Malicious:	false
Preview:	........................................b..9../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.228161660957704
Encrypted:	false
SSDEEP:	12:PwvMvYfYebvqBQFUt82wS/+2wa5JfYebvqBvJ:Yv2YfYebvZg8N5EJfYebvk
MD5:	0D31E42238F4D47C84237CA267C94E2D
SHA1:	F807FD7EBBCDED614C7569A4EC9586B69D3FCC2B
SHA-256:	A3246957B4EA10ECDFBE7881BE5D3C59BB20E4C5F726DA5FF3BC9C5D96B0D3BF
SHA-512:	376C59C5BE37A940FFA7906917F0D6D6EE598D1498CA227D0791AF09C4002C82135C50E84E4E63EAF2802BE21C54C01672945D099CDDEEFFC542A00F7D901756
Malicious:	false
Preview:	2024/09/02-09:30:18.108 21b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/02-09:30:18.112 21b4 Recovering log #3.2024/09/02-09:30:18.116 21b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.228161660957704
Encrypted:	false
SSDEEP:	12:PwvMvYfYebvqBQFUt82wS/+2wa5JfYebvqBvJ:Yv2YfYebvZg8N5EJfYebvk
MD5:	0D31E42238F4D47C84237CA267C94E2D
SHA1:	F807FD7EBBCDED614C7569A4EC9586B69D3FCC2B
SHA-256:	A3246957B4EA10ECDFBE7881BE5D3C59BB20E4C5F726DA5FF3BC9C5D96B0D3BF
SHA-512:	376C59C5BE37A940FFA7906917F0D6D6EE598D1498CA227D0791AF09C4002C82135C50E84E4E63EAF2802BE21C54C01672945D099CDDEEFFC542A00F7D901756
Malicious:	false
Preview:	2024/09/02-09:30:18.108 21b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/02-09:30:18.112 21b4 Recovering log #3.2024/09/02-09:30:18.116 21b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1551dff5-2c92-40fa-8f1b-d9726007d9de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\160b5f21-365d-4da5-97ac-e00bd6e31c8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6191ea3e-75dd-410a-8fdd-b52995d43010.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF40655.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2ee2e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d98b2dc5-45a3-4090-b7f8-3b741508c5bf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.205487418991173
Encrypted:	false
SSDEEP:	12:PhRvYfYebvqBZFUt82IG/Z/+225JfYebvqBaJ:LYfYebvyg83w2JfYebvL
MD5:	8D35570B19C50D314FE1D7EC9A0B3A5C
SHA1:	20ADA707D43785E1AF1EE4C1DB70C30DFDF2FD5F
SHA-256:	404200E0F82A36148396BE94A62DFB2B70C82EDE38C246D9EAF45A7F71592E9C
SHA-512:	F849D4CB59BE02AB5DA4B150CC195262717E58FDB81566CF2CDE607CB468D6E2871C91DCFDD47B806CCC2E8773C49FBE6AE90FB5FF14104C589635E5DC2116AB
Malicious:	false
Preview:	2024/09/02-09:30:33.475 2320 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/02-09:30:33.476 2320 Recovering log #3.2024/09/02-09:30:33.479 2320 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.205487418991173
Encrypted:	false
SSDEEP:	12:PhRvYfYebvqBZFUt82IG/Z/+225JfYebvqBaJ:LYfYebvyg83w2JfYebvL
MD5:	8D35570B19C50D314FE1D7EC9A0B3A5C
SHA1:	20ADA707D43785E1AF1EE4C1DB70C30DFDF2FD5F
SHA-256:	404200E0F82A36148396BE94A62DFB2B70C82EDE38C246D9EAF45A7F71592E9C
SHA-512:	F849D4CB59BE02AB5DA4B150CC195262717E58FDB81566CF2CDE607CB468D6E2871C91DCFDD47B806CCC2E8773C49FBE6AE90FB5FF14104C589635E5DC2116AB
Malicious:	false
Preview:	2024/09/02-09:30:33.475 2320 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/02-09:30:33.476 2320 Recovering log #3.2024/09/02-09:30:33.479 2320 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.158032815079283
Encrypted:	false
SSDEEP:	6:P+gRFZ4yq2Pwkn23oH+TcwtpIFUt82+KLu1Zmw+2+KL4RkwOwkn23oH+Tcwta/Wd:PDjbvYfYebmFUt8281/+2O5JfYebaUJ
MD5:	E02D41FAE8B21FF0C8EC12A8C5DB6858
SHA1:	88EB7E12C98BA4500BD4F1C3B181D087D06CE417
SHA-256:	4D5AC8A129EAEA18CF92686D36826AD951A9A8F69C564C1C5FBB75709F30EFE7
SHA-512:	8C2A9BDE0B65DF8BB2E84A10C369C2B2276EBB0F613F11BBBF6A8A91886CBFB0B349BAE4174C26DCB1E3C4EA92986B000ABA8EB6A981B3D612C916C42CF0F90B
Malicious:	false
Preview:	2024/09/02-09:30:16.724 1e10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/02-09:30:16.926 1e10 Recovering log #3.2024/09/02-09:30:16.926 1e10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.158032815079283
Encrypted:	false
SSDEEP:	6:P+gRFZ4yq2Pwkn23oH+TcwtpIFUt82+KLu1Zmw+2+KL4RkwOwkn23oH+Tcwta/Wd:PDjbvYfYebmFUt8281/+2O5JfYebaUJ
MD5:	E02D41FAE8B21FF0C8EC12A8C5DB6858
SHA1:	88EB7E12C98BA4500BD4F1C3B181D087D06CE417
SHA-256:	4D5AC8A129EAEA18CF92686D36826AD951A9A8F69C564C1C5FBB75709F30EFE7
SHA-512:	8C2A9BDE0B65DF8BB2E84A10C369C2B2276EBB0F613F11BBBF6A8A91886CBFB0B349BAE4174C26DCB1E3C4EA92986B000ABA8EB6A981B3D612C916C42CF0F90B
Malicious:	false
Preview:	2024/09/02-09:30:16.724 1e10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/02-09:30:16.926 1e10 Recovering log #3.2024/09/02-09:30:16.926 1e10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06414041547870637
Encrypted:	false
SSDEEP:	3:netEl1lhtlFen:etE3Un
MD5:	2F41E4E4E51291C20953C99CFAD758AF
SHA1:	D5E6E544262C34A6BDA73172D4805583EC4CB8E6
SHA-256:	EF960FF8A67B92A3F15AAD2D31904F3C182BE45CFA78FB151CDADD40F59B81CA
SHA-512:	2287479A119563DFD2ECC1F0B9DAD31C12FA1E8DDC15FB4009244EFA46B9D33D96AAC0B7A66B05D2548F7475A4780DDF9EEBE118F8FE8D02ED83BD33AC0907E4
Malicious:	false
Preview:	...............;...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b1feb6fd-2d21-492d-9ac3-fda55c7581d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e95249a3-f27b-430e-adcd-fe97d3f643c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9332
Entropy (8bit):	5.188304215939353
Encrypted:	false
SSDEEP:	96:sVAlqltJ1mb9uRHxXC1zYhdH5FUY4sY5Th6Cp9/x+6M8muecmAeC7ue4zvr82X6p:sVAlSJxHxMol5FUY4sYPpj+FVA88FBf
MD5:	B6F6375D447E65A199382556945F9661
SHA1:	DB4E11D3523A17C71E3C33C1C4E266AF998EA835
SHA-256:	1BDB127D3FB404BCEA2FAE6FD5D7F80EBD77435AECCFE06206A1C7680F4A33C0
SHA-512:	67CE9B1D01D995422DBA8C16D0645F15151908E00821FE02A0D412EEE946C52DDA35AE85AC59A2C80B2C18965C74065C047BD981940464E7D9B286A2A090A8A9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369757416961732","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f4e4eedc-6a17-442a-a43e-5c2872e40e0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.21056454913585
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQvxljlHDWv/ll3seGKT9rcQ6xsX:/XntM+4ljljWHll3sedhOsX
MD5:	ADFED36C4D79C82FF0264AAD78B5BD8E
SHA1:	2F4CB31A7DE14E13420E9022120B83EDDFDBBD65
SHA-256:	82D7360BEF4AF4F779EB5ECE1DF715442281ADCC509B7572B719850758134137
SHA-512:	3CA2188A7C374CC274E30F67529E03FE4AC5AF33FFA63331913EBA7239A8E196E37C619222CFB2827C470562EB5A2AFC42F0F4EE1D70B074BD1ADF5CDF7BB579
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.................&f................1.30................39_config..........6.....n ..1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.159419825292834
Encrypted:	false
SSDEEP:	6:P+OD1wkn23oH+Tcwtfrl2KLllJBq2Pwkn23oH+TcwtfrK+IFUv:P7yfYeb1LnJBvYfYeb23FUv
MD5:	F7E347B2FCA297985AD3130B070BE1C7
SHA1:	C8A0CADBD5E5FD0006307E0AA736CABEC339E070
SHA-256:	844C94A755750664CCD0FCAAC32F8FD77EC6D99870E1E0B9263C20AC634302A1
SHA-512:	7DB238FE0940ECB4895F253E89E44D0DBFF739A3A2F4521B374FA32A444B6F89479A2D3928E717BD2CA8CAA859B1CE5F800BE7CF0984DA0485580C2113C69F1B
Malicious:	false
Preview:	2024/09/02-09:30:16.997 1e00 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/09/02-09:30:17.009 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9275169283101077
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/5/Xt21tzJ3PEWXZi+5uh/2Rdj0QWQ0:G0nYUtPrPJ6B/XMtzNP9i+4hORdZx0
MD5:	A21ADD072F290BB8025555CE1EF9014C
SHA1:	BC07D222EF610DCE637F72866D14D7560926EB5C
SHA-256:	1D64B6F3EBA3FC479C8A8A34AB1D17D263E71AC35707450E323DA7E482E48195
SHA-512:	164C693EE34EE72E4401DFF69B7E4CFE2BA100E7F3C8D2665B91BFC200011F808FEF9EB878656CE54478EF7F6B814EAD722C4EDC74F7300BA5E1B696F6CA1CCF
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_........e.................18_......E...................37_.....`0M..................38_......Hf..................39_.......w<.................20_.........................20_..........................19_.....}....................18_......m=.................37_.....uTN..................38_.......h.................39_........I.................21_......j...................21_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.139446144668779
Encrypted:	false
SSDEEP:	6:P+OHP1wkn23oH+Tcwtfrzs52KLll+vIq2Pwkn23oH+TcwtfrzAdIFUv:PYfYebs9LnDvYfYeb9FUv
MD5:	154F40473999D9F326EEF2CF8899317E
SHA1:	DA7D6E82B68395357683EF08863011189E08AF4B
SHA-256:	9DAD8472F9B4678A8D066B4D67046A243C42D1CF37040834176FB3ACE38AAD8B
SHA-512:	123917C1BE1235234804FEB8CFE20D617D28BDF8CCDF255F4D7E629BF39D9E522C69C6BCFA18C1FE13A0310EF8BA99E3A0B511B6114EF7E083CC616D6ECEC28D
Malicious:	false
Preview:	2024/09/02-09:30:16.968 1e00 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/09/02-09:30:16.992 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlfBll/:Ls3fTt
MD5:	CE0C9F08EAB7428BE0D838082C4ABDB4
SHA1:	6953D1255BDB29E569E0C39C41EA2A6134EAFBD3
SHA-256:	EC518237B6F6370B8E2302348DD05C6A4098A970253377B674CB504555CAEED4
SHA-512:	F72F58B0E8B9A1EA615B2DDAA76A750EA7A20E53E0C07DF38DC3C49333043D12869FF52FAABA0898AC01BFE7DB6734A2196CD401878F56005A55B374A7D92772
Malicious:	false
Preview:	..........................................9../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlrtBlt:Ls3LX
MD5:	BAFD1F702B7B4D4F0DDDD30005491996
SHA1:	D15A3EAE5A344FC78CB265835D4668EC677B6878
SHA-256:	D75F99B616A1BDE15CDB8648FF4FB2B45A8F8102E26AA9B148AAA92B23C54E0C
SHA-512:	9E4097B503D8436123D4D8064A0A165AB8DDD66E9661969C44633D3BC2647FB3F3876A388E28535FD88B812730FCDE0763D9D584E4DDEFED892EC029CA616889
Malicious:	false
Preview:	........................................0D.9../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793602944449112
Encrypted:	false
SSDEEP:	192:akRca3oieiRUSh56qRAq1k8SPxVLZ7VTiq:akRT3LV56q3QxVNZTiq
MD5:	7626696BE8C157D1ADD0A77262348075
SHA1:	AB3DEF605E8784B8576CEBCE4C3B2B52A1FFC70C
SHA-256:	4FAD551F45FFB9B147AE4056F74056593037D28DDF790BCEB8FF581D2F965484
SHA-512:	1D899C4C5F5D07E33593E09D488B97C1E18F86E85BC6B03F550CC6C4746940BAFB86434770ECD9813D726B1EA79B0493114130F6379F0B29919A614B553183B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADrD/AUophb80LeDVCNKPKkSGp/e933kihbFjtuKarkAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d864.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793602944449112
Encrypted:	false
SSDEEP:	192:akRca3oieiRUSh56qRAq1k8SPxVLZ7VTiq:akRT3LV56q3QxVNZTiq
MD5:	7626696BE8C157D1ADD0A77262348075
SHA1:	AB3DEF605E8784B8576CEBCE4C3B2B52A1FFC70C
SHA-256:	4FAD551F45FFB9B147AE4056F74056593037D28DDF790BCEB8FF581D2F965484
SHA-512:	1D899C4C5F5D07E33593E09D488B97C1E18F86E85BC6B03F550CC6C4746940BAFB86434770ECD9813D726B1EA79B0493114130F6379F0B29919A614B553183B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADrD/AUophb80LeDVCNKPKkSGp/e933kihbFjtuKarkAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f87f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793602944449112
Encrypted:	false
SSDEEP:	192:akRca3oieiRUSh56qRAq1k8SPxVLZ7VTiq:akRT3LV56q3QxVNZTiq
MD5:	7626696BE8C157D1ADD0A77262348075
SHA1:	AB3DEF605E8784B8576CEBCE4C3B2B52A1FFC70C
SHA-256:	4FAD551F45FFB9B147AE4056F74056593037D28DDF790BCEB8FF581D2F965484
SHA-512:	1D899C4C5F5D07E33593E09D488B97C1E18F86E85BC6B03F550CC6C4746940BAFB86434770ECD9813D726B1EA79B0493114130F6379F0B29919A614B553183B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADrD/AUophb80LeDVCNKPKkSGp/e933kihbFjtuKarkAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f8ae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793602944449112
Encrypted:	false
SSDEEP:	192:akRca3oieiRUSh56qRAq1k8SPxVLZ7VTiq:akRT3LV56q3QxVNZTiq
MD5:	7626696BE8C157D1ADD0A77262348075
SHA1:	AB3DEF605E8784B8576CEBCE4C3B2B52A1FFC70C
SHA-256:	4FAD551F45FFB9B147AE4056F74056593037D28DDF790BCEB8FF581D2F965484
SHA-512:	1D899C4C5F5D07E33593E09D488B97C1E18F86E85BC6B03F550CC6C4746940BAFB86434770ECD9813D726B1EA79B0493114130F6379F0B29919A614B553183B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADrD/AUophb80LeDVCNKPKkSGp/e933kihbFjtuKarkAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f8be.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793602944449112
Encrypted:	false
SSDEEP:	192:akRca3oieiRUSh56qRAq1k8SPxVLZ7VTiq:akRT3LV56q3QxVNZTiq
MD5:	7626696BE8C157D1ADD0A77262348075
SHA1:	AB3DEF605E8784B8576CEBCE4C3B2B52A1FFC70C
SHA-256:	4FAD551F45FFB9B147AE4056F74056593037D28DDF790BCEB8FF581D2F965484
SHA-512:	1D899C4C5F5D07E33593E09D488B97C1E18F86E85BC6B03F550CC6C4746940BAFB86434770ECD9813D726B1EA79B0493114130F6379F0B29919A614B553183B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADrD/AUophb80LeDVCNKPKkSGp/e933kihbFjtuKarkAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF31917.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793602944449112
Encrypted:	false
SSDEEP:	192:akRca3oieiRUSh56qRAq1k8SPxVLZ7VTiq:akRT3LV56q3QxVNZTiq
MD5:	7626696BE8C157D1ADD0A77262348075
SHA1:	AB3DEF605E8784B8576CEBCE4C3B2B52A1FFC70C
SHA-256:	4FAD551F45FFB9B147AE4056F74056593037D28DDF790BCEB8FF581D2F965484
SHA-512:	1D899C4C5F5D07E33593E09D488B97C1E18F86E85BC6B03F550CC6C4746940BAFB86434770ECD9813D726B1EA79B0493114130F6379F0B29919A614B553183B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADrD/AUophb80LeDVCNKPKkSGp/e933kihbFjtuKarkAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF34c9a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793602944449112
Encrypted:	false
SSDEEP:	192:akRca3oieiRUSh56qRAq1k8SPxVLZ7VTiq:akRT3LV56q3QxVNZTiq
MD5:	7626696BE8C157D1ADD0A77262348075
SHA1:	AB3DEF605E8784B8576CEBCE4C3B2B52A1FFC70C
SHA-256:	4FAD551F45FFB9B147AE4056F74056593037D28DDF790BCEB8FF581D2F965484
SHA-512:	1D899C4C5F5D07E33593E09D488B97C1E18F86E85BC6B03F550CC6C4746940BAFB86434770ECD9813D726B1EA79B0493114130F6379F0B29919A614B553183B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADrD/AUophb80LeDVCNKPKkSGp/e933kihbFjtuKarkAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF34caa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793602944449112
Encrypted:	false
SSDEEP:	192:akRca3oieiRUSh56qRAq1k8SPxVLZ7VTiq:akRT3LV56q3QxVNZTiq
MD5:	7626696BE8C157D1ADD0A77262348075
SHA1:	AB3DEF605E8784B8576CEBCE4C3B2B52A1FFC70C
SHA-256:	4FAD551F45FFB9B147AE4056F74056593037D28DDF790BCEB8FF581D2F965484
SHA-512:	1D899C4C5F5D07E33593E09D488B97C1E18F86E85BC6B03F550CC6C4746940BAFB86434770ECD9813D726B1EA79B0493114130F6379F0B29919A614B553183B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADrD/AUophb80LeDVCNKPKkSGp/e933kihbFjtuKarkAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c228.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793602944449112
Encrypted:	false
SSDEEP:	192:akRca3oieiRUSh56qRAq1k8SPxVLZ7VTiq:akRT3LV56q3QxVNZTiq
MD5:	7626696BE8C157D1ADD0A77262348075
SHA1:	AB3DEF605E8784B8576CEBCE4C3B2B52A1FFC70C
SHA-256:	4FAD551F45FFB9B147AE4056F74056593037D28DDF790BCEB8FF581D2F965484
SHA-512:	1D899C4C5F5D07E33593E09D488B97C1E18F86E85BC6B03F550CC6C4746940BAFB86434770ECD9813D726B1EA79B0493114130F6379F0B29919A614B553183B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADrD/AUophb80LeDVCNKPKkSGp/e933kihbFjtuKarkAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e938.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793602944449112
Encrypted:	false
SSDEEP:	192:akRca3oieiRUSh56qRAq1k8SPxVLZ7VTiq:akRT3LV56q3QxVNZTiq
MD5:	7626696BE8C157D1ADD0A77262348075
SHA1:	AB3DEF605E8784B8576CEBCE4C3B2B52A1FFC70C
SHA-256:	4FAD551F45FFB9B147AE4056F74056593037D28DDF790BCEB8FF581D2F965484
SHA-512:	1D899C4C5F5D07E33593E09D488B97C1E18F86E85BC6B03F550CC6C4746940BAFB86434770ECD9813D726B1EA79B0493114130F6379F0B29919A614B553183B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADrD/AUophb80LeDVCNKPKkSGp/e933kihbFjtuKarkAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF438df.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793602944449112
Encrypted:	false
SSDEEP:	192:akRca3oieiRUSh56qRAq1k8SPxVLZ7VTiq:akRT3LV56q3QxVNZTiq
MD5:	7626696BE8C157D1ADD0A77262348075
SHA1:	AB3DEF605E8784B8576CEBCE4C3B2B52A1FFC70C
SHA-256:	4FAD551F45FFB9B147AE4056F74056593037D28DDF790BCEB8FF581D2F965484
SHA-512:	1D899C4C5F5D07E33593E09D488B97C1E18F86E85BC6B03F550CC6C4746940BAFB86434770ECD9813D726B1EA79B0493114130F6379F0B29919A614B553183B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADrD/AUophb80LeDVCNKPKkSGp/e933kihbFjtuKarkAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlfqaa/:Ls3Zq
MD5:	1BE026A4A2F845BF1F2B894E701E413D
SHA1:	1567E27F5D307B28C4B2757AC274626C499AF4FB
SHA-256:	E72DA83BA31369567B799F05375914BAE3FB971445219518039637E28B2551E6
SHA-512:	B8759E1E9CDCCD703A8B814F439AFE28F6EBE0154793BA98F91ABF396076B7FB862D19B52D114F4D3D84CA7C716E37756116F83BEE55167DC001376A158E4779
Malicious:	false
Preview:	..........................................9../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a3a068d0-3667-49f4-b776-1dc2078ca3b0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.058912769516801
Encrypted:	false
SSDEEP:	384:WtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwXT3xLkBno+Mh0lkdHd5qB:aMGQ7FCYXGIgtDAWtJ4n3tkBnYh02tdi
MD5:	81EB55119C8F0638841C2DE1EFF8B7C0
SHA1:	26D12839812B5300994FACA9B3790BD99EB309FC
SHA-256:	0D0CF6B67F17CD477F617AFE6CC9DD998F6E386523BFD1BA4D4807D30995A7E6
SHA-512:	1A394029ADBA7B689F2D5F99CCC28B3CCA1FF37E14025AD3055EBBD746968E74A6D51E9141A8A28136DD99641482E9D20D401F32465D32FEC2ED9E129184A824
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369757416992547","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ab5ed8e7-10c5-468d-8b33-82ae13abcd20.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.799246220526371
Encrypted:	false
SSDEEP:	192:fsNwRca3ojeiRUfJQCknh6qRAq1k8SPxVLZ7VTiQ:fsNwRT3QSWBnh6q3QxVNZTiQ
MD5:	234842794FD10E398A66FDBE3BC84EAE
SHA1:	D7871009CCD76D762C52010DD93E76C7DE031BA0
SHA-256:	9D648FD4DCF7E4FB3A5C036681C34D23CAF51CD01DA32D53FAAC7015CF5EE777
SHA-512:	5435E398B90CA6DEAF10D56F74040F6B1CD300F181727E734B2DA7E434FC47818697FB81E528E2145761051E477F20E733462E92BD722E035BF6ACBB7F940F38
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b94f823c-ce6f-488d-9237-59c7fbed8097.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.805521881112413
Encrypted:	false
SSDEEP:	192:fsNARca3ojeiRUqJQCknh6qRAq1k8SPxVLZ7VTiQ:fsNART3QNWBnh6q3QxVNZTiQ
MD5:	E99955294BB2D7D9C5C38059704E3A24
SHA1:	603ECDDF1681A697183A9CADEB170D9BFD9FCDBB
SHA-256:	F58639D5F897E403CF0B00430D3CAC4CE8D14E268D83C22894A579E564065A93
SHA-512:	63D16DB4BA8E9EB7FAD510B7AB7A304492776B62D8130FA7970D3F7FEACFD1BDFF2D907CFE31EFC83F5F713725AC1C4BF5357624A0984E524D9B859F3C9532A5
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c98524bc-b4d9-479f-95ea-c648a05d2c89.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.833255632932888
Encrypted:	false
SSDEEP:	192:fsNwRca3ojeiRUfm14Q5wU1QknE96qRAq1k8SPxVLZ7VTiB:fsNwRT3QSOf5ws7nE96q3QxVNZTiB
MD5:	7BA5D7E18609DE482B1F15D8A58CEE7E
SHA1:	AF165F4127AD2DE26E68A7638634D79491646D80
SHA-256:	57CFE059621DD7F7A4710BCE33CB309169DF43BE91DFB35E9AA995B0D706A278
SHA-512:	0D8A10A5F31AF651A02692769AEB8F56D95F51E4BD1A5B5635E7C6CB4A5F2FF2BF3BE00F96741A10F6C9DB84F834CC8C0F0157F623E0B703C14F4605BD8A92BA
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ca925ca0-4437-40f8-83d1-ece04ce2ddbd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.8330831451837835
Encrypted:	false
SSDEEP:	192:fsNwRca3ojeiRUfm14Q5wxyzknE96qRAq1k8SPxVLZ7VTiB:fsNwRT3QSOf5w0wnE96q3QxVNZTiB
MD5:	D1012DDDB80EF91250EB6EA7329D4961
SHA1:	A69F3722EC1B02955173308417259D0A7B566C86
SHA-256:	563AB40BE1B28580D74A04E7ABFC288E4317EBCA58D0072A92BB3AD0C3038A0F
SHA-512:	F2FF526118C80A2316DB64AB06D8E7EC53DF1621920818ADB9C53845E95C9E057A5563DABC6B878AEA771CAFC449A09F438E150A7BD33DF4D54E5DDB8203A69E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d3a57f73-d4d0-4dde-b0a4-192c27f9d6aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.833255632932888
Encrypted:	false
SSDEEP:	192:fsNwRca3ojeiRUfm14Q5wU1QknE96qRAq1k8SPxVLZ7VTiB:fsNwRT3QSOf5ws7nE96q3QxVNZTiB
MD5:	7BA5D7E18609DE482B1F15D8A58CEE7E
SHA1:	AF165F4127AD2DE26E68A7638634D79491646D80
SHA-256:	57CFE059621DD7F7A4710BCE33CB309169DF43BE91DFB35E9AA995B0D706A278
SHA-512:	0D8A10A5F31AF651A02692769AEB8F56D95F51E4BD1A5B5635E7C6CB4A5F2FF2BF3BE00F96741A10F6C9DB84F834CC8C0F0157F623E0B703C14F4605BD8A92BA
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d7bf58e6-323d-40db-9d6c-9a3e5611a00a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46958
Entropy (8bit):	6.081184884735528
Encrypted:	false
SSDEEP:	768:aMGQ7FCYXGIgtDAWtJ4nUtSrXPi2VuMrV33F+qLrOeAIJrvtGv0azXFh02tdi:aMGQ5XMBGUA6Of533F+gLvtGcaznK
MD5:	FF3C708F64E5C562BDFF852DB14AAC75
SHA1:	31A4BC4E071B33A7CE11A54115FF959E644926FE
SHA-256:	5A001D903940B52F187A33C9D00DD56C0A07F3E3FA3FE7C05E987A05032B8A25
SHA-512:	FFDA3A60846F5BB250C9709AD1701D011F1257018BFC11ADA2373114EC3B42EB5AA8D38408FC330A323816067318A6AEC8E64B3F91A895AC7CCA6621293F24F9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369757416992547","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e2cc6015-554d-4d85-b619-00d55d2fe109.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46919
Entropy (8bit):	6.08128715876309
Encrypted:	false
SSDEEP:	768:aMGQ7FCYXGIgtDAWtJ4n5tSrXPi2VuMrV33F+qLrOeAIJrvtGv0azXFh02tdi:aMGQ5XMBG5A6Of533F+gLvtGcaznK
MD5:	1DD429F5FA33EDE3955C9B77CBC7A94A
SHA1:	1B7EFE0BD5E9BAE2B5F5C6D31BFBE80A21DB2804
SHA-256:	3FE37E12E05B52240DC5462BD61600F9AC587FA1143C1C988A4AF5AFC8BBF3A9
SHA-512:	E2D5D583118F7A763A8A3F7723C752FD3ACA0792DDC19C4F37070AF36F9C7C12C8517AE50C8B04526D8D1D7EF5C4B6A66B3C199D6007252C81F0567E72DB1139
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369757416992547","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f7f2d16b-e478-464d-bafc-336b51ca8046.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793602944449112
Encrypted:	false
SSDEEP:	192:akRca3oieiRUSh56qRAq1k8SPxVLZ7VTiq:akRT3LV56q3QxVNZTiq
MD5:	7626696BE8C157D1ADD0A77262348075
SHA1:	AB3DEF605E8784B8576CEBCE4C3B2B52A1FFC70C
SHA-256:	4FAD551F45FFB9B147AE4056F74056593037D28DDF790BCEB8FF581D2F965484
SHA-512:	1D899C4C5F5D07E33593E09D488B97C1E18F86E85BC6B03F550CC6C4746940BAFB86434770ECD9813D726B1EA79B0493114130F6379F0B29919A614B553183B3
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACwWDnMQq7LQ4fsB0j0/5T/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAADrD/AUophb80LeDVCNKPKkSGp/e933kihbFjtuKarkAAAAAA

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.838018804230977
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxoxl9Il8ureatERvwlTQjdpA6JgHVPKsumrdjd1rc:mVYN+RYAbASwVCszdE
MD5:	DABAA80B10B57E16850B2B9B78467A68
SHA1:	8958F6A34EA06DAAE12E18E9469D67549450DA8C
SHA-256:	1203BBC22EBA44F903C1A59C784F789D939D999890975C6FCC3968A349A0EEB6
SHA-512:	679BFE665CFB86E2D8734090192999487B90C30F746B17772DF9F89156595D0668F5788CBCF06351C2FA866B12C773CA13EAA9B3963FAE3F026C2A4F26DFDD38
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.P.r.2.l.0.T.9.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.s.F.g.5.z.E.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.004866372040191
Encrypted:	false
SSDEEP:	96:kY3wCdEg8sDwX2+n4niZQ3dtOdSPMD+A15+Nttmv:ka5DH8n4niZQNtXXE+/kv
MD5:	E05DA5E5604308A428ACF6A29D88D259
SHA1:	FB532DCF1509E0893E0DD96E987E07534A5989DE
SHA-256:	B117066AE3F0C7258C1F383301C4D7FECC744219C7562DDAEABBEF3138B938AE
SHA-512:	BE132DA582552690BF045C547C3705D4A66C29141FC6C81060D17949A2BC24CB093317EF5BEDEF602B3759E1CBE021386D764A63FC6E9A028D11E6BA252657B2
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Y.h.Q.s.f.j.z.9.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.s.F.g.5.z.E.

C:\Users\user\AppData\Local\Temp\2622e520-6611-429e-9f79-a36c40c9e84d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\48c3c148-0031-4ab5-8829-4fab32441e0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\6e1aaf8a-cfb3-4df9-8278-97a8e928b0df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.357924912592242
Encrypted:	false
SSDEEP:	12:Yj7RDh0Dkv/hXV2TU7J56s/hXVJ4Ky0Dkv/hXVYE56s/C:YPL062w155Jly0635M
MD5:	F897BDC4820CDA57A94183121EF889A6
SHA1:	E072D43FB04629A6631691D9D273194AEF985058
SHA-256:	C5C2209BE5EECF8FC29F30308DFA5E4DAA069F73E985D1E09D88022BFAE47235
SHA-512:	EB87F9FC5A8437A7D71B7DAC325B4140231C92B490DDA77740E6E19FBA14CE1C3D60E7FD747C717D003EE9831A6AF61A7BDA89E2D2B334E977A5CD649E8DE837
Malicious:	false
Preview:	{"logTime": "0902/133004", "correlationVector":"5DE5BD09E8974E01A5CDAADFA84DEDEB","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0902/133019", "correlationVector":"7oJrDg6/wCdIvPNpxYSig4","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0902/133019", "correlationVector":"8AF8611E2BFA40CF85D42C69DA7BE5F5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0902/133019", "correlationVector":"25FUH1zhFqDNewMRI8FUZJ","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\fb137042-28b8-4da7-9a2c-6d88f6eef414.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\48c3c148-0031-4ab5-8829-4fab32441e0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8624_1876247591\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir8624_506936866\2622e520-6611-429e-9f79-a36c40c9e84d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8624_506936866\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8624_506936866\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8624_506936866\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8624_506936866\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1SIWI8APKDJZHIPZGC72.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5238246403589684
Encrypted:	false
SSDEEP:	48:2EptdODJysJbr5zBdLXuH2kDp02AptdODJysJbr5zngdLXuH2k+21:E3uWkDTvnIuWkz
MD5:	D85D4FCEFBA06851614EDF62EA9988C7
SHA1:	649EF469A7820E44DD62D6D05139D264FDBFF902
SHA-256:	662BB7FC4A82505F3C456087219EC579EF388758AF787279D2385B36F62E00BF
SHA-512:	C257F2CE097FBA9821F751ADD61AC5E930422E5738878B004DDB8631135ABE34F431359A8787AF7BC63DCED9BB601BE5454515FA84009BAC6169D611CC3CE577
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....u7<....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1....."Y.k..PROGRA~2.........O.I"Y.k....................V.....v...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWQ`..MICROS~1..D......(Ux."Y.k.............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8."Y.k...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8."Y.k..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8."Y.k....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............2V......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5242615145379745
Encrypted:	false
SSDEEP:	48:2E9vekdODtysJbr5zBdLXuH2kDp02AptdODJysJbr5zngdLXuH2k+21:Eh3uWkDTvnIuWkz
MD5:	3AA94787C67927FB7D3AAB0BAADDFF12
SHA1:	623ED3D5CB34A6E6879706938BD7AE2FC813E44E
SHA-256:	00883704B05B33747BC5EB42EB65F8A0103E8B2E7E75BE5866E9BA5E62D92C07
SHA-512:	A84F2C1E6A7D2DD0084F9AAF1EBD052116DEF530D8E5AAF03BF0703C1DBF664EF5FDBB97E1C2DD9E3C3AAE1C30A83925FEE7138196CBC5441D9AECCB22921B3E
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....u7<....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWR`..PROGRA~2.........O.IDWR`....................V.....A.E.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWQ`..MICROS~1..D......(Ux."Y.k.............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8."Y.k..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8."Y.k....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............2V......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YMB34JP3XJC3NZV5H68W.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5242615145379745
Encrypted:	false
SSDEEP:	48:2E9vekdODtysJbr5zBdLXuH2kDp02AptdODJysJbr5zngdLXuH2k+21:Eh3uWkDTvnIuWkz
MD5:	3AA94787C67927FB7D3AAB0BAADDFF12
SHA1:	623ED3D5CB34A6E6879706938BD7AE2FC813E44E
SHA-256:	00883704B05B33747BC5EB42EB65F8A0103E8B2E7E75BE5866E9BA5E62D92C07
SHA-512:	A84F2C1E6A7D2DD0084F9AAF1EBD052116DEF530D8E5AAF03BF0703C1DBF664EF5FDBB97E1C2DD9E3C3AAE1C30A83925FEE7138196CBC5441D9AECCB22921B3E
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....u7<....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWR`..PROGRA~2.........O.IDWR`....................V.....A.E.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWQ`..MICROS~1..D......(Ux."Y.k.............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8."Y.k..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8."Y.k....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............2V......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5238246403589684
Encrypted:	false
SSDEEP:	48:2EptdODJysJbr5zBdLXuH2kDp02AptdODJysJbr5zngdLXuH2k+21:E3uWkDTvnIuWkz
MD5:	D85D4FCEFBA06851614EDF62EA9988C7
SHA1:	649EF469A7820E44DD62D6D05139D264FDBFF902
SHA-256:	662BB7FC4A82505F3C456087219EC579EF388758AF787279D2385B36F62E00BF
SHA-512:	C257F2CE097FBA9821F751ADD61AC5E930422E5738878B004DDB8631135ABE34F431359A8787AF7BC63DCED9BB601BE5454515FA84009BAC6169D611CC3CE577
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....u7<....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1....."Y.k..PROGRA~2.........O.I"Y.k....................V.....v...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWQ`..MICROS~1..D......(Ux."Y.k.............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8."Y.k...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8."Y.k..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8."Y.k....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............2V......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579763032117833
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	3a8e001d779a4b8d093e96295c4af868
SHA1:	707ddb1927149d7e8cac6bd4c480fa638d003e7a
SHA256:	217a7dc3e97859a1940310cca2dc0018e6c553679447afc49b96e7c0a392a4c5
SHA512:	f90c27f20f57ad96902ed21639dc20526e3af1e299366abb6381ac34066f7978e2a93c28ab3db7b8051be888ee6e5b0be7200b8d7bd165fae10ef803e56abed8
SSDEEP:	12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTE:SqDEvCTbMWu7rQYlBQcBiT6rprG8asE
TLSH:	15159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D5BD49 [Mon Sep 2 13:27:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F7D1C926A13h
jmp 00007F7D1C92631Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F7D1C9264FDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F7D1C9264CAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F7D1C9290BDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F7D1C929108h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F7D1C9290F1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	38792f4b6279675ad8304f4c745dc4db	False	0.286953125	data	5.1653318593150255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 2, 2024 15:29:53.169581890 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 2, 2024 15:30:02.777580976 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 2, 2024 15:30:04.899462938 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:04.899494886 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:04.899569035 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:04.899859905 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:04.899876118 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.036426067 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.036463976 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.036638021 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.036817074 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.036829948 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.540955067 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.637960911 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.637994051 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.639292002 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.639306068 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.639375925 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.652283907 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.658934116 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.659033060 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.666637897 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.666651011 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.667711973 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.667772055 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.714394093 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.714422941 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.754930019 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.755060911 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.758477926 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.758500099 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.767754078 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.796829939 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:05.796885967 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:05.797024965 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:05.797310114 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:05.797353983 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:05.797406912 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:05.797754049 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:05.797761917 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:05.797811985 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:05.798118114 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:05.798131943 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:05.798652887 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:05.798660994 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:05.798721075 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:05.798990011 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:05.799009085 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:05.799407959 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:05.799422979 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:05.799709082 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:05.799717903 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:05.809609890 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.813114882 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.813149929 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.813157082 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.813169956 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.813175917 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.813183069 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.813205004 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.813221931 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.813237906 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.813262939 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.813621998 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.813677073 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.813767910 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.851639032 CEST	49748	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.851666927 CEST	443	49748	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.853353024 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.853375912 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.853384018 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.853418112 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.853436947 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.853449106 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.853466034 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.853476048 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.853481054 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.853490114 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.853512049 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.857985973 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:05.858036995 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:05.858103991 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:05.858730078 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:05.858748913 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:05.953210115 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.953233004 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.953322887 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.953341007 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.953387022 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.954670906 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.954685926 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.954763889 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:05.954771996 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:05.954808950 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:06.037106991 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:06.037128925 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:06.037184000 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:06.037199974 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:06.037234068 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:06.037239075 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:06.037261963 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:06.037266970 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:06.037286043 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:06.037312984 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:06.037314892 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:06.037360907 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:06.037926912 CEST	49749	443	192.168.2.4	13.107.246.73
Sep 2, 2024 15:30:06.037939072 CEST	443	49749	13.107.246.73	192.168.2.4
Sep 2, 2024 15:30:06.245192051 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.245630980 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.245656967 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.246747971 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.246807098 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.248294115 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.248399019 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.248501062 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.249236107 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.249439955 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.249454021 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.250627041 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.250684977 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.250972986 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.251449108 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.251463890 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.251945972 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.252021074 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.252116919 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.252125978 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.252557039 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.252633095 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.253803015 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.253905058 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.253937006 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.261321068 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.261558056 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.261571884 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.262624025 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.262805939 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.263890982 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.263962984 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.264051914 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.296504974 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.296523094 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.308504105 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.309627056 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.309639931 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.311141014 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.311371088 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.311386108 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.312454939 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.312541008 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.313653946 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.313755989 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.313954115 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.313961029 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.340848923 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.340859890 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.340868950 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.340886116 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.340903997 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.356503963 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.356712103 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.373989105 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.374063969 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.374209881 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.374363899 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.374377012 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.375793934 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.375874996 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.376085043 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.376094103 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.388165951 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.388254881 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.388540983 CEST	49758	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.388561010 CEST	443	49758	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.400156021 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.400199890 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.400283098 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.400398970 CEST	49756	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:06.400420904 CEST	443	49756	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:06.447885990 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.447963953 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:06.448014021 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.448198080 CEST	49759	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:06.448220015 CEST	443	49759	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:07.058505058 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:07.058556080 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:07.058629990 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:07.073690891 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:07.073719978 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:07.156445980 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.156502962 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.156589985 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.156841040 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.156848907 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.156932116 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.157092094 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.157109976 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.157231092 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.157241106 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.592338085 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.601928949 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.601955891 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.602359056 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.609210014 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.609291077 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.618561983 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.628294945 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.628323078 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.628751040 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.629379988 CEST	49763	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:07.629422903 CEST	443	49763	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:07.629503012 CEST	49764	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:07.629539967 CEST	443	49764	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:07.629543066 CEST	49763	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:07.629607916 CEST	49764	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:07.629863977 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.629942894 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.630026102 CEST	49763	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:07.630044937 CEST	443	49763	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:07.630125999 CEST	49764	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:07.630139112 CEST	443	49764	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:07.653934956 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.695861101 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:07.695969105 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:07.700745106 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:07.700772047 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:07.701013088 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:07.747997999 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:07.763521910 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:07.784718990 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.808512926 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:07.945586920 CEST	49765	443	192.168.2.4	142.251.35.164
Sep 2, 2024 15:30:07.945640087 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:07.945744991 CEST	49765	443	192.168.2.4	142.251.35.164
Sep 2, 2024 15:30:07.946044922 CEST	49765	443	192.168.2.4	142.251.35.164
Sep 2, 2024 15:30:07.946064949 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:07.948945999 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:07.949018002 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:07.949079990 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:07.949256897 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:07.949273109 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:07.949290037 CEST	49760	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:07.949295998 CEST	443	49760	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:08.080766916 CEST	443	49764	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.083184004 CEST	443	49763	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.125271082 CEST	49764	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.229631901 CEST	49764	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.229659081 CEST	443	49764	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.229778051 CEST	49763	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.229792118 CEST	443	49763	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.230453968 CEST	443	49763	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.230465889 CEST	443	49763	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.230528116 CEST	49763	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.231200933 CEST	443	49763	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.231267929 CEST	49763	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.232002974 CEST	443	49764	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.232070923 CEST	49764	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.232793093 CEST	443	49764	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.232844114 CEST	49764	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.244369030 CEST	49763	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.244784117 CEST	49763	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.244791985 CEST	443	49763	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.245043039 CEST	443	49763	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.245388031 CEST	49764	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.245573997 CEST	443	49764	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.245745897 CEST	49764	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.245757103 CEST	443	49764	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.272285938 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:08.272345066 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:08.272418976 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:08.273956060 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:08.273972034 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:08.294677973 CEST	49764	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.350102901 CEST	443	49764	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.350230932 CEST	443	49764	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.350502014 CEST	49764	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.351336956 CEST	443	49763	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.351392031 CEST	49763	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.352382898 CEST	49764	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.352401018 CEST	443	49764	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.353332996 CEST	49763	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.353354931 CEST	443	49763	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.400578976 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:08.400990963 CEST	49765	443	192.168.2.4	142.251.35.164
Sep 2, 2024 15:30:08.401026011 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:08.402144909 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:08.402218103 CEST	49765	443	192.168.2.4	142.251.35.164
Sep 2, 2024 15:30:08.405899048 CEST	49765	443	192.168.2.4	142.251.35.164
Sep 2, 2024 15:30:08.406008005 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:08.406368017 CEST	49765	443	192.168.2.4	142.251.35.164
Sep 2, 2024 15:30:08.406383991 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:08.454020023 CEST	49765	443	192.168.2.4	142.251.35.164
Sep 2, 2024 15:30:08.499737024 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:08.499782085 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:08.499810934 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:08.499828100 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:08.499876976 CEST	49765	443	192.168.2.4	142.251.35.164
Sep 2, 2024 15:30:08.499917030 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:08.499974966 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:08.500129938 CEST	49765	443	192.168.2.4	142.251.35.164
Sep 2, 2024 15:30:08.501652002 CEST	49765	443	192.168.2.4	142.251.35.164
Sep 2, 2024 15:30:08.501677990 CEST	443	49765	142.251.35.164	192.168.2.4
Sep 2, 2024 15:30:08.720649004 CEST	49767	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.720698118 CEST	443	49767	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.720917940 CEST	49767	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.721223116 CEST	49768	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.721232891 CEST	443	49768	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.721290112 CEST	49768	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.721684933 CEST	49767	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.721699953 CEST	443	49767	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.722362995 CEST	49768	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.722377062 CEST	443	49768	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.902582884 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:08.902676105 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:08.904575109 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:08.904586077 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:08.904927969 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:08.906363964 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:08.952511072 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:09.162456036 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:09.162460089 CEST	443	49768	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:09.162538052 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:09.162589073 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:09.162961960 CEST	49768	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:09.162986040 CEST	443	49768	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:09.163427114 CEST	443	49768	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:09.163497925 CEST	49768	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:09.164014101 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:09.164055109 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:09.164086103 CEST	49766	443	192.168.2.4	184.28.90.27
Sep 2, 2024 15:30:09.164093018 CEST	443	49766	184.28.90.27	192.168.2.4
Sep 2, 2024 15:30:09.164172888 CEST	443	49768	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:09.164226055 CEST	49768	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:09.164484024 CEST	49768	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:09.164549112 CEST	443	49768	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:09.170972109 CEST	443	49767	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:09.171346903 CEST	49767	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:09.171355009 CEST	443	49767	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:09.171811104 CEST	443	49767	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:09.171886921 CEST	49767	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:09.172585964 CEST	443	49767	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:09.172646999 CEST	49767	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:09.172918081 CEST	49767	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:09.172988892 CEST	443	49767	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:09.213361979 CEST	49767	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:09.213383913 CEST	443	49767	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:09.263396025 CEST	49767	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:09.333602905 CEST	49768	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:09.333636045 CEST	443	49768	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:09.450983047 CEST	49768	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:15.061043024 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:15.061100960 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:15.067161083 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:15.068648100 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:15.068695068 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:15.825527906 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:15.825807095 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:15.838438988 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:15.838454008 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:15.838888884 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:15.887511969 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:16.393496990 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:16.440505981 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:16.642509937 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:16.642537117 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:16.642546892 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:16.642576933 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:16.642595053 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:16.642604113 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:16.642671108 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:16.642699003 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:16.642709970 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:16.642723083 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:16.642729044 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:16.642784119 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:16.642784119 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:16.642798901 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:16.642863989 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:16.642909050 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:18.477902889 CEST	49769	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:18.477930069 CEST	443	49769	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:20.148065090 CEST	49723	80	192.168.2.4	199.232.214.172
Sep 2, 2024 15:30:20.153342962 CEST	80	49723	199.232.214.172	192.168.2.4
Sep 2, 2024 15:30:20.153636932 CEST	49723	80	192.168.2.4	199.232.214.172
Sep 2, 2024 15:30:20.183631897 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:20.183691025 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:20.187349081 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:20.187349081 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:20.187393904 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:20.912033081 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:20.919231892 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:20.919256926 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:20.919745922 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:20.919766903 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:20.919862032 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:20.919862032 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:20.919871092 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:20.920104980 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:20.920507908 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:20.922810078 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:20.922883034 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:20.923120022 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:20.923131943 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:20.988564968 CEST	49783	443	192.168.2.4	13.107.246.42
Sep 2, 2024 15:30:20.988611937 CEST	443	49783	13.107.246.42	192.168.2.4
Sep 2, 2024 15:30:20.988738060 CEST	49783	443	192.168.2.4	13.107.246.42
Sep 2, 2024 15:30:20.988917112 CEST	49783	443	192.168.2.4	13.107.246.42
Sep 2, 2024 15:30:20.988929033 CEST	443	49783	13.107.246.42	192.168.2.4
Sep 2, 2024 15:30:21.027465105 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.162785053 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.162827969 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.162872076 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.162899017 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.166204929 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.166245937 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.166254044 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.175045967 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.175096035 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.175112963 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.182848930 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.183005095 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.183017015 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.191231012 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.191298962 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.191315889 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.199557066 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.199613094 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.199623108 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.207915068 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.207961082 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.207994938 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.216154099 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.216217995 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.216249943 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.245219946 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.245275021 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.245311975 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.248948097 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.248995066 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.249022007 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.257364988 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.257426977 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.257456064 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.265635967 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.265693903 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.265729904 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.273997068 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.274048090 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.274077892 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.282222986 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.282274961 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.282303095 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.290576935 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.290641069 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.290668964 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.297931910 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.297981977 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.298010111 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.304645061 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.304696083 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.304734945 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.310848951 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.310895920 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.310925961 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.316984892 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.317034960 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.317060947 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.322881937 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.322938919 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.322967052 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.328952074 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.329005957 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.329030991 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.334568024 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.334619045 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.334645033 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.340471029 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.340533972 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.340564013 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.344141006 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.344191074 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.344214916 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.347619057 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.347671032 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.347691059 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.351069927 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.351115942 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.351133108 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.354510069 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.354556084 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.354584932 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.358026028 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.358078003 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.358103037 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.361537933 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.361586094 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.361601114 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.364942074 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.364989042 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.365015030 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.368400097 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.368488073 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.368515015 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.371896029 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.371951103 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.371975899 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.375387907 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.375432968 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.375458002 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.378856897 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.378909111 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.378937960 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.382241964 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.382294893 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.382314920 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.385709047 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.385768890 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.385796070 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.389621973 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.389676094 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.389703989 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.392698050 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.392750978 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.392765999 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.396122932 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.396172047 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.396195889 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.399570942 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.399636984 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.399663925 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.403100967 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.403145075 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.403168917 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.406637907 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.406691074 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.406716108 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.409882069 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.409929037 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.409953117 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.413114071 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.413151979 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.413177967 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.416393995 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.416440010 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.416464090 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.419550896 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.419603109 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.419630051 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.422830105 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.422878981 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.422902107 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.425724983 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.425779104 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.425786972 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.425806046 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.425836086 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.428262949 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.430622101 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.430674076 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.430701017 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.430794954 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.430807114 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.430818081 CEST	443	49781	142.250.186.129	192.168.2.4
Sep 2, 2024 15:30:21.430869102 CEST	49781	443	192.168.2.4	142.250.186.129
Sep 2, 2024 15:30:21.598278046 CEST	443	49783	13.107.246.42	192.168.2.4
Sep 2, 2024 15:30:21.603374004 CEST	49783	443	192.168.2.4	13.107.246.42
Sep 2, 2024 15:30:21.603406906 CEST	443	49783	13.107.246.42	192.168.2.4
Sep 2, 2024 15:30:21.604782104 CEST	443	49783	13.107.246.42	192.168.2.4
Sep 2, 2024 15:30:21.604841948 CEST	49783	443	192.168.2.4	13.107.246.42
Sep 2, 2024 15:30:21.606066942 CEST	49783	443	192.168.2.4	13.107.246.42
Sep 2, 2024 15:30:21.606157064 CEST	443	49783	13.107.246.42	192.168.2.4
Sep 2, 2024 15:30:21.606358051 CEST	49783	443	192.168.2.4	13.107.246.42
Sep 2, 2024 15:30:21.606373072 CEST	443	49783	13.107.246.42	192.168.2.4
Sep 2, 2024 15:30:21.699265003 CEST	443	49783	13.107.246.42	192.168.2.4
Sep 2, 2024 15:30:21.699322939 CEST	443	49783	13.107.246.42	192.168.2.4
Sep 2, 2024 15:30:21.699333906 CEST	443	49783	13.107.246.42	192.168.2.4
Sep 2, 2024 15:30:21.699357986 CEST	49783	443	192.168.2.4	13.107.246.42
Sep 2, 2024 15:30:21.699398994 CEST	49783	443	192.168.2.4	13.107.246.42
Sep 2, 2024 15:30:21.708023071 CEST	49783	443	192.168.2.4	13.107.246.42
Sep 2, 2024 15:30:21.708060026 CEST	443	49783	13.107.246.42	192.168.2.4
Sep 2, 2024 15:30:22.505326986 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:22.505400896 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:22.505877018 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:22.527920008 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:22.528004885 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:22.531127930 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:23.672903061 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:23.672952890 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:23.673132896 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:23.673577070 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:23.673613071 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:23.673666000 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:23.673845053 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:23.673871040 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:23.674071074 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:23.674088001 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:23.726877928 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:23.726948023 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:23.727034092 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:23.727811098 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:23.727844954 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.560374022 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.560411930 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.560596943 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.560878992 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.560893059 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.575489998 CEST	49789	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:24.575503111 CEST	443	49789	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:24.576112986 CEST	49789	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:24.576411963 CEST	49789	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:24.576431036 CEST	443	49789	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:24.591432095 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.591463089 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.591536999 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.591815948 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.591830969 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.712239027 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:24.712485075 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:24.712503910 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:24.712531090 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.712790966 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.712806940 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.712958097 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.713174105 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.713182926 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.713563919 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:24.713627100 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:24.713872910 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.713933945 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.714380026 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.714438915 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.715259075 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:24.715329885 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:24.715455055 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:24.715697050 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.715775967 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.716027975 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.716085911 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.716157913 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.716173887 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.716365099 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.716370106 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.760504961 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:24.762378931 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:24.762379885 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.762389898 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:24.799030066 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.809278965 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:24.846112967 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:24.846115112 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.846190929 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:24.846211910 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.846259117 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:24.846276999 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.846467972 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.846535921 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.846587896 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.846612930 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.846631050 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:24.847044945 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:24.847058058 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:24.847460032 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:24.847465992 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.140635967 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.140811920 CEST	443	49789	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:25.146903992 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.184382915 CEST	49789	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:25.184382915 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.200207949 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.224181890 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.224200964 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.224603891 CEST	49789	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:25.224618912 CEST	443	49789	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:25.224721909 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.224736929 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.225497007 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.225564957 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.225966930 CEST	443	49789	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:25.226032972 CEST	49789	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:25.226568937 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.226577997 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.226635933 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.243525982 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.243623972 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.289818048 CEST	49789	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:25.290036917 CEST	443	49789	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:25.290219069 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.290368080 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.293642998 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.293684959 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.293703079 CEST	49789	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:25.293720007 CEST	443	49789	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:25.293855906 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.293873072 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.341451883 CEST	49789	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:25.341451883 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.341463089 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.392245054 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.392327070 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.393106937 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.393156052 CEST	443	49789	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:25.393220901 CEST	443	49789	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:25.393774033 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.393816948 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.393826008 CEST	49789	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:25.393855095 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.421958923 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.421984911 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:25.422645092 CEST	49789	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:25.422665119 CEST	443	49789	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:25.422868967 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:25.422874928 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.391372919 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.391396046 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.391469002 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.391575098 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.391633034 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.391685963 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.391870975 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.391885996 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.391994953 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.392009974 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.846184969 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.856312037 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.880904913 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.880913973 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.880919933 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.880935907 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.881472111 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.881478071 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.911776066 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.911892891 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.913949966 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.914057016 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.967020988 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.967138052 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:39.038753986 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.038805008 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.038885117 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.039072990 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.039087057 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.583564997 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.584009886 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.584033966 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.585117102 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.585284948 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.586342096 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.586412907 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.586622000 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.632498026 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.639470100 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.639493942 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.685657978 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.686559916 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.688101053 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.688111067 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.688155890 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.688162088 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.688186884 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:39.688196898 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.688196898 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.688220978 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.688335896 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.688857079 CEST	49793	443	192.168.2.4	152.195.19.97
Sep 2, 2024 15:30:39.688878059 CEST	443	49793	152.195.19.97	192.168.2.4
Sep 2, 2024 15:30:40.354204893 CEST	49794	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.354243994 CEST	443	49794	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.354497910 CEST	49794	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.354633093 CEST	49795	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.354666948 CEST	443	49795	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.354862928 CEST	49795	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.354957104 CEST	49794	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.354969025 CEST	443	49794	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.355122089 CEST	49795	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.355133057 CEST	443	49795	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.788985968 CEST	443	49795	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.789005041 CEST	443	49794	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.789308071 CEST	49794	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.789336920 CEST	443	49794	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.789444923 CEST	49795	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.789472103 CEST	443	49795	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.789707899 CEST	443	49794	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.789824963 CEST	443	49795	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.790127993 CEST	49794	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.790241957 CEST	443	49794	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.790452003 CEST	49795	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.790534019 CEST	443	49795	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.790663004 CEST	49794	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.790821075 CEST	49795	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.832509041 CEST	443	49795	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.832534075 CEST	443	49794	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.918209076 CEST	443	49795	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.918294907 CEST	443	49795	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.918431044 CEST	443	49794	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.918472052 CEST	49795	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.918519020 CEST	443	49794	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.918577909 CEST	49794	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.919102907 CEST	49794	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.919120073 CEST	443	49794	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.919325113 CEST	49795	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.919342995 CEST	443	49795	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:53.756102085 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:53.756184101 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:53.756269932 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:53.765472889 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:53.765549898 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:53.765618086 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:54.215643883 CEST	49767	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:54.215672016 CEST	443	49767	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:54.340532064 CEST	49768	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:54.340549946 CEST	443	49768	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:55.845144033 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:55.845185995 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:55.845246077 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:55.845643997 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:55.845659971 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.632097006 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.632173061 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:56.636001110 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:56.636018991 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.636219978 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.649564028 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:56.692507029 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.967539072 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.967565060 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.967580080 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.967631102 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:56.967643976 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.967691898 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:56.968663931 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.968697071 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.968725920 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:56.968732119 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.968746901 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:56.968758106 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:56.968874931 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:57.011524916 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:57.011555910 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:57.011569977 CEST	49798	443	192.168.2.4	40.68.123.157
Sep 2, 2024 15:30:57.011575937 CEST	443	49798	40.68.123.157	192.168.2.4
Sep 2, 2024 15:30:59.955967903 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:59.956017017 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:59.956093073 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:59.956298113 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:59.956306934 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:59.956351995 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:59.956567049 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:59.956583023 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:59.956769943 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:59.956784964 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.410331011 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.410690069 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.410720110 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.411040068 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.411078930 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.411354065 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.411410093 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.411539078 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.411545038 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.411936045 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.412199020 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.412338018 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.465348005 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.465818882 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:02.889826059 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:02.889882088 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:02.889951944 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:02.890208960 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:02.890254021 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:02.890315056 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:02.890393019 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:02.890405893 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:02.890577078 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:02.890589952 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.324409962 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.324847937 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.324877977 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.325226068 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.325572968 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.325817108 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.325906038 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.326096058 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.326122999 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.326519966 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.326932907 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.327009916 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.372025013 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.372045040 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.412493944 CEST	49804	443	192.168.2.4	23.200.0.9
Sep 2, 2024 15:31:03.412538052 CEST	443	49804	23.200.0.9	192.168.2.4
Sep 2, 2024 15:31:03.412650108 CEST	49804	443	192.168.2.4	23.200.0.9
Sep 2, 2024 15:31:03.412902117 CEST	49804	443	192.168.2.4	23.200.0.9
Sep 2, 2024 15:31:03.412914991 CEST	443	49804	23.200.0.9	192.168.2.4
Sep 2, 2024 15:31:03.896702051 CEST	443	49804	23.200.0.9	192.168.2.4
Sep 2, 2024 15:31:03.897152901 CEST	49804	443	192.168.2.4	23.200.0.9
Sep 2, 2024 15:31:03.897183895 CEST	443	49804	23.200.0.9	192.168.2.4
Sep 2, 2024 15:31:03.897561073 CEST	443	49804	23.200.0.9	192.168.2.4
Sep 2, 2024 15:31:03.897861004 CEST	49804	443	192.168.2.4	23.200.0.9
Sep 2, 2024 15:31:03.897933006 CEST	443	49804	23.200.0.9	192.168.2.4
Sep 2, 2024 15:31:03.898020983 CEST	49804	443	192.168.2.4	23.200.0.9
Sep 2, 2024 15:31:03.944504023 CEST	443	49804	23.200.0.9	192.168.2.4
Sep 2, 2024 15:31:04.093100071 CEST	443	49804	23.200.0.9	192.168.2.4
Sep 2, 2024 15:31:04.093173027 CEST	443	49804	23.200.0.9	192.168.2.4
Sep 2, 2024 15:31:04.093241930 CEST	49804	443	192.168.2.4	23.200.0.9
Sep 2, 2024 15:31:04.093466043 CEST	49804	443	192.168.2.4	23.200.0.9
Sep 2, 2024 15:31:04.093487024 CEST	443	49804	23.200.0.9	192.168.2.4
Sep 2, 2024 15:31:07.512141943 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:07.512180090 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:07.533174038 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:07.533190966 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:07.950150967 CEST	49724	80	192.168.2.4	199.232.214.172
Sep 2, 2024 15:31:07.955393076 CEST	80	49724	199.232.214.172	192.168.2.4
Sep 2, 2024 15:31:07.955504894 CEST	49724	80	192.168.2.4	199.232.214.172
Sep 2, 2024 15:31:15.320804119 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:15.320883036 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:15.320965052 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:15.321631908 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:15.321738005 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:15.321788073 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:18.239413023 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:18.239480019 CEST	443	49803	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:18.239547014 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:18.240437984 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:18.240508080 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:18.240564108 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:38.761940956 CEST	49792	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:38.761965036 CEST	443	49792	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:38.777743101 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:38.777761936 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:39.216636896 CEST	49767	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:31:39.216664076 CEST	443	49767	142.251.40.174	192.168.2.4
Sep 2, 2024 15:31:39.343106031 CEST	49768	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:31:39.343139887 CEST	443	49768	142.251.40.174	192.168.2.4
Sep 2, 2024 15:31:52.512001038 CEST	49762	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:52.512026072 CEST	443	49762	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:52.544635057 CEST	49761	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:52.544646025 CEST	443	49761	162.159.61.3	192.168.2.4
Sep 2, 2024 15:32:00.324855089 CEST	49799	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:32:00.324855089 CEST	49800	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:32:00.324898005 CEST	443	49799	162.159.61.3	192.168.2.4
Sep 2, 2024 15:32:00.324909925 CEST	443	49800	162.159.61.3	192.168.2.4
Sep 2, 2024 15:32:03.247450113 CEST	49803	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:32:03.247450113 CEST	49802	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:32:03.247502089 CEST	443	49802	172.64.41.3	192.168.2.4
Sep 2, 2024 15:32:03.247502089 CEST	443	49803	172.64.41.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 2, 2024 15:30:01.407265902 CEST	53	61796	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:02.873270035 CEST	55501	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:02.873614073 CEST	55764	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:03.728008986 CEST	53	50247	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:03.745204926 CEST	53	57920	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:05.786545038 CEST	58698	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:05.786983967 CEST	55976	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:05.787648916 CEST	59165	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:05.787843943 CEST	53265	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:05.788275003 CEST	62548	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:05.788674116 CEST	50908	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:05.789108992 CEST	53897	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:05.789297104 CEST	53631	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:05.793595076 CEST	53	58698	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:05.794775963 CEST	53	59165	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:05.795981884 CEST	53	50908	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:05.795988083 CEST	53	62548	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:05.796149015 CEST	53	53631	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:05.796298027 CEST	53	53897	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:05.796336889 CEST	53	55976	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:05.796864986 CEST	53	53265	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:05.850393057 CEST	60463	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:05.850646973 CEST	49432	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:05.857187986 CEST	53	60463	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:05.857230902 CEST	53	49432	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:06.843847036 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.156022072 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.277237892 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.277306080 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.277313948 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.277467966 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.277475119 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.278651953 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.278798103 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.280741930 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.280827999 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.281085968 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.281194925 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.376991987 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.377140045 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.377145052 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.377150059 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.377890110 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.377937078 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.378211975 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.379040003 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.379313946 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.380063057 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.473820925 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.525337934 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.529547930 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.529761076 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.625819921 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.626884937 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.626914024 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.628576040 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.844511032 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.844943047 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:07.940681934 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.944103003 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.944112062 CEST	443	54381	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:07.944417000 CEST	54381	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:08.356250048 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.720197916 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.786773920 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.794048071 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.794188976 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.797754049 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.797985077 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.811666965 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.811768055 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.815732956 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.816945076 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.817509890 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.817935944 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.818576097 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.818808079 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.910564899 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.910700083 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.911061049 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.912019014 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.924438953 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.925301075 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.925859928 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.936103106 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.936124086 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:08.943177938 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:08.972732067 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:09.033138037 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:16.656549931 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:16.656593084 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:16.747924089 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:16.781208038 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:16.801311970 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:16.801579952 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:16.803109884 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:16.828385115 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:16.918565035 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:19.571315050 CEST	138	138	192.168.2.4	192.168.2.255
Sep 2, 2024 15:30:20.175004959 CEST	54947	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:20.175132990 CEST	59226	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:20.182429075 CEST	53	54947	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:20.182909966 CEST	53	59226	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:23.155040026 CEST	53	65233	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:23.646799088 CEST	49521	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:23.647201061 CEST	60129	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:23.647542953 CEST	53094	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:23.647883892 CEST	59181	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:23.653800011 CEST	53	49521	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:23.654074907 CEST	53	60129	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:23.654082060 CEST	53	53094	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:23.654347897 CEST	53	59181	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:23.719408035 CEST	54143	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:23.719683886 CEST	49883	53	192.168.2.4	1.1.1.1
Sep 2, 2024 15:30:23.726279974 CEST	53	54143	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:23.726288080 CEST	53	49883	1.1.1.1	192.168.2.4
Sep 2, 2024 15:30:37.608855963 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:37.609050989 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:37.700000048 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:37.729762077 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:37.729774952 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:37.730067015 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:37.763443947 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:37.845194101 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:37.939449072 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:37.939526081 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:38.030046940 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:38.044526100 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:38.044596910 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:38.044883966 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:38.075397968 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:38.160125971 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:38.391073942 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.700592041 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.798659086 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:38.798763037 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:38.815570116 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.815586090 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.815695047 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.815704107 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.815807104 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:38.880429983 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.889065027 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:38.903309107 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:38.903321028 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:38.906718016 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:38.911252975 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.912698984 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.913299084 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.914424896 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.914614916 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:38.938627958 CEST	57988	443	192.168.2.4	142.251.40.174
Sep 2, 2024 15:30:39.002701044 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:39.002753019 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:39.002758026 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:39.002774954 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:39.003222942 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:39.003329039 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:39.003351927 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:39.006104946 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:39.007761002 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:39.021555901 CEST	443	57988	142.251.40.174	192.168.2.4
Sep 2, 2024 15:30:39.037621021 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:39.038021088 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:39.093070030 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:39.123781919 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:40.350882053 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:40.351517916 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:40.353549004 CEST	53184	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.443247080 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:40.444058895 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:40.444422960 CEST	443	57996	162.159.61.3	192.168.2.4
Sep 2, 2024 15:30:40.444606066 CEST	57996	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:30:40.668812037 CEST	53184	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.803575039 CEST	443	53184	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.803585052 CEST	443	53184	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.803591013 CEST	443	53184	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.803641081 CEST	443	53184	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.803647995 CEST	443	53184	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.804289103 CEST	53184	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.806108952 CEST	53184	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.806281090 CEST	53184	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.899319887 CEST	443	53184	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.900237083 CEST	443	53184	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.900243044 CEST	443	53184	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.900248051 CEST	443	53184	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:40.900507927 CEST	53184	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.900886059 CEST	53184	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:40.994530916 CEST	443	53184	172.64.41.3	192.168.2.4
Sep 2, 2024 15:30:41.029506922 CEST	53184	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:30:59.955708027 CEST	57801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.262708902 CEST	57801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.384604931 CEST	443	57801	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.384619951 CEST	443	57801	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.384627104 CEST	443	57801	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.384633064 CEST	443	57801	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.385370970 CEST	57801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.387375116 CEST	57801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.387489080 CEST	57801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.387746096 CEST	57801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.387860060 CEST	57801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.476891041 CEST	443	57801	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.476902962 CEST	443	57801	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.476912975 CEST	443	57801	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.476917028 CEST	443	57801	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.477571011 CEST	57801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.477652073 CEST	57801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.477973938 CEST	443	57801	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.478818893 CEST	443	57801	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.479427099 CEST	443	57801	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.479573011 CEST	57801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:00.566823959 CEST	443	57801	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:00.606259108 CEST	57801	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:02.889584064 CEST	63335	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.200424910 CEST	63335	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.311696053 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.311733961 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.312836885 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.313291073 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.313327074 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.313344955 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.313611984 CEST	63335	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.315892935 CEST	63335	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.316210032 CEST	63335	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.316324949 CEST	63335	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.316581011 CEST	63335	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.316667080 CEST	63335	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.407499075 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.407511950 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.407516003 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.407520056 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.407524109 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.408092022 CEST	63335	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.408185959 CEST	63335	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.408668995 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.409712076 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.411804914 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.412005901 CEST	63335	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:03.499583960 CEST	443	63335	172.64.41.3	192.168.2.4
Sep 2, 2024 15:31:03.528517962 CEST	63335	443	192.168.2.4	172.64.41.3
Sep 2, 2024 15:31:10.031330109 CEST	61267	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:10.031495094 CEST	61267	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:10.031826019 CEST	61267	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:10.031960964 CEST	61267	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:10.372315884 CEST	61267	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:10.592009068 CEST	443	61267	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:10.592020035 CEST	443	61267	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:10.592025042 CEST	443	61267	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:10.592246056 CEST	443	61267	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:10.592250109 CEST	443	61267	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:10.592698097 CEST	61267	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:10.592842102 CEST	61267	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:10.592926979 CEST	61267	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:10.592993021 CEST	61267	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:10.703418970 CEST	443	61267	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:10.703428030 CEST	443	61267	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:10.703826904 CEST	61267	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:10.800549984 CEST	443	61267	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:10.801496983 CEST	443	61267	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:10.803134918 CEST	443	61267	162.159.61.3	192.168.2.4
Sep 2, 2024 15:31:10.805418015 CEST	61267	443	192.168.2.4	162.159.61.3
Sep 2, 2024 15:31:10.806751966 CEST	65349	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:10.806875944 CEST	65349	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:11.234359980 CEST	443	65349	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:11.234375000 CEST	443	65349	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:11.235091925 CEST	65349	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:11.235229015 CEST	65349	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:11.235490084 CEST	65349	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:11.235507011 CEST	65349	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:11.235625029 CEST	65349	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:11.235646963 CEST	65349	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:11.251719952 CEST	443	65349	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:11.326137066 CEST	443	65349	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:11.326796055 CEST	443	65349	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:11.327040911 CEST	65349	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:11.341192961 CEST	443	65349	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:11.341620922 CEST	443	65349	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:11.341625929 CEST	443	65349	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:11.341943979 CEST	65349	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:11.342024088 CEST	65349	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:11.374094009 CEST	65349	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:11.431909084 CEST	443	65349	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:41.402100086 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:41.402316093 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:42.466289043 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:42.772696018 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:42.772715092 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:42.772720098 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:42.773520947 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:42.773595095 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:42.773936987 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:42.773947001 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:42.861704111 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:42.862160921 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:42.862873077 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:42.863014936 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:42.863246918 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:42.863256931 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:42.863437891 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:42.883276939 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:42.883291960 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:42.883579016 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:42.919271946 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:42.951119900 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:42.976588011 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:43.780370951 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:43.780433893 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:43.870373011 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:43.884618044 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:43.884953976 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:43.884965897 CEST	443	54626	142.250.176.206	192.168.2.4
Sep 2, 2024 15:31:43.919280052 CEST	54626	443	192.168.2.4	142.250.176.206
Sep 2, 2024 15:31:43.998999119 CEST	443	54626	142.250.176.206	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 2, 2024 15:30:02.873270035 CEST	192.168.2.4	1.1.1.1	0xc32	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:02.873614073 CEST	192.168.2.4	1.1.1.1	0x8fb	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Sep 2, 2024 15:30:05.786545038 CEST	192.168.2.4	1.1.1.1	0xc344	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.786983967 CEST	192.168.2.4	1.1.1.1	0x9334	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 15:30:05.787648916 CEST	192.168.2.4	1.1.1.1	0xaffa	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.787843943 CEST	192.168.2.4	1.1.1.1	0xfc4b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 15:30:05.788275003 CEST	192.168.2.4	1.1.1.1	0xbd7e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.788674116 CEST	192.168.2.4	1.1.1.1	0xfc61	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 15:30:05.789108992 CEST	192.168.2.4	1.1.1.1	0x3d4b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.789297104 CEST	192.168.2.4	1.1.1.1	0x3727	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 15:30:05.850393057 CEST	192.168.2.4	1.1.1.1	0x5e43	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.850646973 CEST	192.168.2.4	1.1.1.1	0x23f5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 15:30:20.175004959 CEST	192.168.2.4	1.1.1.1	0x338a	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:20.175132990 CEST	192.168.2.4	1.1.1.1	0x6625	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Sep 2, 2024 15:30:23.646799088 CEST	192.168.2.4	1.1.1.1	0x81a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:23.647201061 CEST	192.168.2.4	1.1.1.1	0x434d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 15:30:23.647542953 CEST	192.168.2.4	1.1.1.1	0xca63	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:23.647883892 CEST	192.168.2.4	1.1.1.1	0x4cf5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 2, 2024 15:30:23.719408035 CEST	192.168.2.4	1.1.1.1	0xe81a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:23.719683886 CEST	192.168.2.4	1.1.1.1	0x56e8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 2, 2024 15:30:02.880626917 CEST	1.1.1.1	192.168.2.4	0x8fb	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:02.880990028 CEST	1.1.1.1	192.168.2.4	0xc32	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:04.898906946 CEST	1.1.1.1	192.168.2.4	0xcfd3	No error (0)	shed.dual-low.s-part-0045.t-0009.t-msedge.net	s-part-0045.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:04.898906946 CEST	1.1.1.1	192.168.2.4	0xcfd3	No error (0)	s-part-0045.t-0009.t-msedge.net		13.107.246.73	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.793595076 CEST	1.1.1.1	192.168.2.4	0xc344	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.793595076 CEST	1.1.1.1	192.168.2.4	0xc344	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.794775963 CEST	1.1.1.1	192.168.2.4	0xaffa	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.794775963 CEST	1.1.1.1	192.168.2.4	0xaffa	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.795981884 CEST	1.1.1.1	192.168.2.4	0xfc61	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 15:30:05.795988083 CEST	1.1.1.1	192.168.2.4	0xbd7e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.795988083 CEST	1.1.1.1	192.168.2.4	0xbd7e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.796149015 CEST	1.1.1.1	192.168.2.4	0x3727	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 15:30:05.796298027 CEST	1.1.1.1	192.168.2.4	0x3d4b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.796298027 CEST	1.1.1.1	192.168.2.4	0x3d4b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.796336889 CEST	1.1.1.1	192.168.2.4	0x9334	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 15:30:05.796864986 CEST	1.1.1.1	192.168.2.4	0xfc4b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 15:30:05.857187986 CEST	1.1.1.1	192.168.2.4	0x5e43	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.857187986 CEST	1.1.1.1	192.168.2.4	0x5e43	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:05.857230902 CEST	1.1.1.1	192.168.2.4	0x23f5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 15:30:20.182429075 CEST	1.1.1.1	192.168.2.4	0x338a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:20.182429075 CEST	1.1.1.1	192.168.2.4	0x338a	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.129	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:20.182909966 CEST	1.1.1.1	192.168.2.4	0x6625	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:20.987910986 CEST	1.1.1.1	192.168.2.4	0xc4a9	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	s-part-0014.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:20.987910986 CEST	1.1.1.1	192.168.2.4	0xc4a9	No error (0)	s-part-0014.t-0009.t-msedge.net		13.107.246.42	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:21.454593897 CEST	1.1.1.1	192.168.2.4	0xa36	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:21.454593897 CEST	1.1.1.1	192.168.2.4	0xa36	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:21.455940962 CEST	1.1.1.1	192.168.2.4	0xe25f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:22.476316929 CEST	1.1.1.1	192.168.2.4	0x738f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:22.476316929 CEST	1.1.1.1	192.168.2.4	0x738f	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:22.477247000 CEST	1.1.1.1	192.168.2.4	0x7914	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:23.653800011 CEST	1.1.1.1	192.168.2.4	0x81a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:23.653800011 CEST	1.1.1.1	192.168.2.4	0x81a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:23.654074907 CEST	1.1.1.1	192.168.2.4	0x434d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 15:30:23.654082060 CEST	1.1.1.1	192.168.2.4	0xca63	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:23.654082060 CEST	1.1.1.1	192.168.2.4	0xca63	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:23.654347897 CEST	1.1.1.1	192.168.2.4	0x4cf5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 15:30:23.726279974 CEST	1.1.1.1	192.168.2.4	0xe81a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:23.726279974 CEST	1.1.1.1	192.168.2.4	0xe81a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:23.726288080 CEST	1.1.1.1	192.168.2.4	0x56e8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 2, 2024 15:30:24.736066103 CEST	1.1.1.1	192.168.2.4	0x27bf	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:24.736066103 CEST	1.1.1.1	192.168.2.4	0x27bf	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:25.510932922 CEST	1.1.1.1	192.168.2.4	0x27bf	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:25.510932922 CEST	1.1.1.1	192.168.2.4	0x27bf	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:26.526298046 CEST	1.1.1.1	192.168.2.4	0x27bf	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:26.526298046 CEST	1.1.1.1	192.168.2.4	0x27bf	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:29.532828093 CEST	1.1.1.1	192.168.2.4	0x27bf	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:29.532828093 CEST	1.1.1.1	192.168.2.4	0x27bf	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 2, 2024 15:30:32.536258936 CEST	1.1.1.1	192.168.2.4	0x27bf	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 2, 2024 15:30:32.536258936 CEST	1.1.1.1	192.168.2.4	0x27bf	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

https:

www.google.com

fs.microsoft.com

slscr.update.microsoft.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49748	13.107.246.73	443	8064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:05 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 13:30:05 UTC	559	IN	HTTP/1.1 200 OK Date: Mon, 02 Sep 2024 13:30:05 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240902T133005Z-16579567576fh7f86y3uqsyhx000000007w0000000006mhk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-09-02 13:30:05 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	13.107.246.73	443	8064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:05 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 13:30:05 UTC	562	IN	HTTP/1.1 200 OK Date: Mon, 02 Sep 2024 13:30:05 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240902T133005Z-165795675762gt5gbs4b9bazh800000007ug000000001etb Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-02 13:30:05 UTC	15822	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-09-02 13:30:05 UTC	16384	IN	Data Raw: 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 Data Ascii: 0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-09-02 13:30:05 UTC	16384	IN	Data Raw: 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-09-02 13:30:06 UTC	16384	IN	Data Raw: d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 Data Ascii: .7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-09-02 13:30:06 UTC	5233	IN	Data Raw: 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 Data Ascii: yVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49757	162.159.61.3	443	8064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 13:30:06 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:06 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcdda4d9ebc1831-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:06 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0b 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49755	162.159.61.3	443	8064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 13:30:06 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:06 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcdda4d8b8c72ab-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:06 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 25 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom%(c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49758	172.64.41.3	443	8064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 13:30:06 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:06 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcdda4dae3ac339-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:06 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 11 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49756	162.159.61.3	443	8064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 13:30:06 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:06 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcdda4dbf358ce9-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:06 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a3 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49759	172.64.41.3	443	8064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:06 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:06 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 13:30:06 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:06 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcdda4e09541819-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:06 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 04 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49760	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:07 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-02 13:30:07 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=98133 Date: Mon, 02 Sep 2024 13:30:07 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49763	142.251.40.174	443	8064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:08 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-02 13:30:08 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Mon, 02 Sep 2024 13:30:08 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49764	142.251.40.174	443	8064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:08 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-02 13:30:08 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Mon, 02 Sep 2024 13:30:08 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49765	142.251.35.164	443	8064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:08 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-02 13:30:08 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 02 Sep 2024 13:19:20 GMT Expires: Tue, 10 Sep 2024 13:19:20 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 648 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-02 13:30:08 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-02 13:30:08 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-02 13:30:08 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-02 13:30:08 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-02 13:30:08 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49766	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:08 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-02 13:30:09 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=98131 Date: Mon, 02 Sep 2024 13:30:09 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-02 13:30:09 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49769	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:16 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DBSmEONwY8sORum&MD=Ln9lffu+ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-02 13:30:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 029fa82e-7b6d-4f02-9e11-f34a6e451712 MS-RequestId: 96af254b-9163-4a24-9be0-8b046dde63c3 MS-CV: zo63faxockqq7J4Y.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 02 Sep 2024 13:30:16 GMT Connection: close Content-Length: 24490
2024-09-02 13:30:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-02 13:30:16 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49781	142.250.186.129	443	8844	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:20 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 13:30:21 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8ljubM27y9AJLGpx84pz5hnpgnwtjZIJd7bxjPlhpHEGx4gTvOqSC4i3RtvorcqhSLsHexmw X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Sun, 01 Sep 2024 19:15:10 GMT Expires: Mon, 01 Sep 2025 19:15:10 GMT Cache-Control: public, max-age=31536000 Age: 65711 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-02 13:30:21 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-09-02 13:30:21 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-09-02 13:30:21 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-09-02 13:30:21 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-09-02 13:30:21 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-09-02 13:30:21 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-09-02 13:30:21 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-09-02 13:30:21 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-09-02 13:30:21 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-09-02 13:30:21 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49783	13.107.246.42	443	8844	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:21 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 13:30:21 UTC	538	IN	HTTP/1.1 200 OK Date: Mon, 02 Sep 2024 13:30:21 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240902T133021Z-16579567576gnfmq2acf56mm7000000007u000000000a9kz Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-02 13:30:21 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49786	172.64.41.3	443	8844	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:24 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:24 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 13:30:24 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:24 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcddac0fee92369-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:24 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fa 48 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomHc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49785	162.159.61.3	443	8844	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:24 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:24 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 13:30:24 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:24 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcddac0ff5441b4-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:24 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 65 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcome()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49787	162.159.61.3	443	8844	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:24 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:24 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 13:30:24 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:24 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcddac0f8c24205-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:24 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fc 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49788	162.159.61.3	443	8844	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:25 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:25 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 13:30:25 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:25 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcddac46dae8c78-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:25 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom'(c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49789	172.64.41.3	443	8844	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:25 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:25 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 13:30:25 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:25 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcddac46a09195d-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:25 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 18 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49790	162.159.61.3	443	8844	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:25 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:25 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-02 13:30:25 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:25 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcddac46eb48cba-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:25 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b0 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49793	152.195.19.97	443	8844	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:39 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725888621&P2=404&P3=2&P4=j7KLYDrzn2Jgh%2f1VGwiFcC4zmt7bOzwV235loKiOZ%2bYLUtm3FHtAMyWOSr44lz2EBYlyTRZayutpDVtCke0ZYw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 25FUH1zhFqDNewMRI8FUZJ Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 13:30:39 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5210370 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Mon, 02 Sep 2024 13:30:39 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-09-02 13:30:39 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49794	172.64.41.3	443	8844	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-09-02 13:30:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcddb2578b9c43b-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d e0 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 0c 00 02 c0 43 c0 43 00 01 00 01 00 00 00 0c 00 04 cc 4f c5 ef c0 43 00 01 00 01 00 00 00 0c 00 04 0d 6b 15 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0CCOCk)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49795	172.64.41.3	443	8844	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:40 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-02 13:30:40 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA)QM
2024-09-02 13:30:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Sep 2024 13:30:40 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bcddb257b96c35d-EWR alt-svc: h3=":443"; ma=86400
2024-09-02 13:30:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d 54 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 4f 00 06 00 01 00 00 00 34 00 23 03 6e 73 31 c0 4f 06 6d 73 6e 68 73 74 c0 11 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 3d 00 0c 01 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomAT-edge-microsoft-comdual-a-0036a-msedgenetO4#ns1Omsnhstx+"$)=9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49798	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:30:56 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DBSmEONwY8sORum&MD=Ln9lffu+ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-02 13:30:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: ec4975ef-621e-4306-a56d-f14e8ce8aba6 MS-RequestId: f72566bd-e9f3-46e5-9d44-4ec5511bf917 MS-CV: YYBpjRMht0+40nPZ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 02 Sep 2024 13:30:56 GMT Connection: close Content-Length: 30005
2024-09-02 13:30:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-02 13:30:56 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49804	23.200.0.9	443	8064	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 13:31:03 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-02 13:31:04 UTC	331	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 Date: Mon, 02 Sep 2024 13:31:04 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.09ac2d17.1725283863.e738e78 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Target ID:	0
Start time:	09:29:57
Start date:	02/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xac0000
File size:	917'504 bytes
MD5 hash:	3A8E001D779A4B8D093E96295C4AF868
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:29:57
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:29:58
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2104,i,16367940205438321316,3256968746704299152,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:29:58
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:29:58
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2384 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	09:30:02
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5804 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:30:03
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4924 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:30:04
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7260 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6ee740000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:30:04
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7260 --field-trial-handle=2184,i,6669094121660174505,6314937514062458572,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6ee740000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:30:16
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	09:30:16
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	09:30:17
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4208 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:30:19
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:8
Imagebase:	0x7ff6ee740000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:30:19
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6056 --field-trial-handle=2116,i,7694523233503407646,13314048766455632147,262144 /prefetch:8
Imagebase:	0x7ff6ee740000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:30:24
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:30:25
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2108,i,15634359973341199469,6712066980228032313,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:30:33
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:30:33
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1772 --field-trial-handle=2096,i,11366431695399386351,13739223435221884792,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:30:46
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:30:46
Start date:	02/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=2072,i,15283468043023513582,12417513997533884230,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	1372
Total number of Limit Nodes:	54

Executed Functions

Function 00ADF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00ADF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B1F474
IsIconic.USER32(00000000), ref: 00B1F47D
ShowWindow.USER32(00000000,00000009), ref: 00B1F48A
SetForegroundWindow.USER32(00000000), ref: 00B1F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B1F4AA
GetCurrentThreadId.KERNEL32 ref: 00B1F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B1F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00B1F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00B1F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00B1F4DE
SetForegroundWindow.USER32(00000000), ref: 00B1F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B1F4F6
keybd_event.USER32(00000012,00000000), ref: 00B1F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B1F50B
keybd_event.USER32(00000012,00000000), ref: 00B1F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B1F519
keybd_event.USER32(00000012,00000000), ref: 00B1F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B1F528
keybd_event.USER32(00000012,00000000), ref: 00B1F52D
SetForegroundWindow.USER32(00000000), ref: 00B1F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00B1F557

Strings

Shell_TrayWnd, xrefs: 00B1F46F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 01f69795073899c50203c3f3da403a54c00ad6485f516cbb1a3b80c2e5dfdd2a
Instruction ID: be6102873f6862b56e9978c47f519ae8dba15337db6e6c680f14288a62718535
Opcode Fuzzy Hash: 01f69795073899c50203c3f3da403a54c00ad6485f516cbb1a3b80c2e5dfdd2a
Instruction Fuzzy Hash: 89314171A403187EEB216BB55C4AFBF7EADEB48B51F1000A5F601E71D1DBB05D40EA60

Function 00AC42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00AC430D

Part of subcall function 00AC6B57: _wcslen.LIBCMT ref: 00AC6B6A

GetCurrentProcess.KERNEL32(?,00B5CB64,00000000,?,?), ref: 00AC4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00AC4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00AC4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00AC4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00AC4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00AC447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00AC44A0

Strings

|O, xrefs: 00B036F8
kernel32.dll, xrefs: 00AC444F
GetNativeSystemInfo, xrefs: 00AC4460

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 11bb2b6c3b9295ee32a4a98cfdf30694ed8ff8d35b7457d1e0d53f6af050aaaf
Instruction ID: cb68cbfc4a9182076d27b0d0bb9fb3eabe9d66737aeca93f618284bd0423a905
Opcode Fuzzy Hash: 11bb2b6c3b9295ee32a4a98cfdf30694ed8ff8d35b7457d1e0d53f6af050aaaf
Instruction Fuzzy Hash: F8A1907690E3C2FFC716C77D6A456A53FF8AB26700B198CDED44193A61DA204908EB2D

Function 00AC42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00AC50AA,?,?,00000000,00000000), ref: 00AC42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00AC50AA,?,?,00000000,00000000), ref: 00AC42C9
LoadResource.KERNEL32(?,00000000,?,?,00AC50AA,?,?,00000000,00000000,?,?,?,?,?,?,00AC4F20), ref: 00B035BE
SizeofResource.KERNEL32(?,00000000,?,?,00AC50AA,?,?,00000000,00000000,?,?,?,?,?,?,00AC4F20), ref: 00B035D3
LockResource.KERNEL32(00AC50AA,?,?,00AC50AA,?,?,00000000,00000000,?,?,?,?,?,?,00AC4F20,?), ref: 00B035E6

Strings

SCRIPT, xrefs: 00AC42BF

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 44060df97590daca21666e89f371cfd1d1202d9525f265cb2de4632993b217e5
Instruction ID: b43b572c4fb2a506af1ef64cdf3f43a6db3bca02442a5cbe50afd62d57f40878
Opcode Fuzzy Hash: 44060df97590daca21666e89f371cfd1d1202d9525f265cb2de4632993b217e5
Instruction Fuzzy Hash: 34117C70200700BFD7218B65DC49F677FBAEBC9B52F2041ADB8069A2A0DB71D800DA20

Function 00B02BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00AC2B6B

Part of subcall function 00AC3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B91418,?,00AC2E7F,?,?,?,00000000), ref: 00AC3A78

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00B82224), ref: 00B02C10
ShellExecuteW.SHELL32(00000000,?,?,00B82224), ref: 00B02C17

Strings

runas, xrefs: 00B02C0B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 256cfaaac6aa59171e67c0de120557690c9517f75368b1fdd10e9f49002d5ae9
Instruction ID: 478cb95a3263012792cdcdc03626fcbc2825b97e670452fef5020a9701e81316
Opcode Fuzzy Hash: 256cfaaac6aa59171e67c0de120557690c9517f75368b1fdd10e9f49002d5ae9
Instruction Fuzzy Hash: 7511B1322083426ACF14FF64DA56FBEBBE49B95340F45486DF082172B2CF218A4AD712

Function 00B2DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00B05222), ref: 00B2DBCE
GetFileAttributesW.KERNELBASE(?), ref: 00B2DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00B2DBEE
FindClose.KERNEL32(00000000), ref: 00B2DBFA

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: cb073719b2704c630d4c586a9f69cb72b74a9f49ce958b910c3019d3f90e9465
Instruction ID: d33c26526baa21a3fb0775f1dc3483040f28fccf9ba13fbc003802b2f51d065e
Opcode Fuzzy Hash: cb073719b2704c630d4c586a9f69cb72b74a9f49ce958b910c3019d3f90e9465
Instruction Fuzzy Hash: 97F0A030810B205B82216F78AC0D9AA3BADDE01336B104B82F83AD20E0EFB15954C696

Function 00B4AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00B4B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B4B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B4B1D4
_wcslen.LIBCMT ref: 00B4B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B4B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B4B236
_wcslen.LIBCMT ref: 00B4B332

Part of subcall function 00B305A7: GetStdHandle.KERNEL32(000000F6), ref: 00B305C6

_wcslen.LIBCMT ref: 00B4B34B
_wcslen.LIBCMT ref: 00B4B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B4B3B6
GetLastError.KERNEL32(00000000), ref: 00B4B407
CloseHandle.KERNEL32(?), ref: 00B4B439
CloseHandle.KERNEL32(00000000), ref: 00B4B44A
CloseHandle.KERNEL32(00000000), ref: 00B4B45C
CloseHandle.KERNEL32(00000000), ref: 00B4B46E
CloseHandle.KERNEL32(?), ref: 00B4B4E3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 15da13e2846b96adb71a97b5fe82774abc651f59f0b20425012a985fecb9de33
Instruction ID: bd9ed8c553966cad59b165650cafe08069d67b14b8188f79718b14a741c69f6a
Opcode Fuzzy Hash: 15da13e2846b96adb71a97b5fe82774abc651f59f0b20425012a985fecb9de33
Instruction Fuzzy Hash: AAF167315083409FCB14EF24C991F2EBBE5AF85314F14899DF99A9B2A2CB31ED44DB52

Function 00ACD730 Relevance: 21.6, APIs: 14, Instructions: 618windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00ACD807
timeGetTime.WINMM ref: 00ACDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00ACDB28
TranslateMessage.USER32(?), ref: 00ACDB7B
DispatchMessageW.USER32(?), ref: 00ACDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00ACDB9F
Sleep.KERNELBASE(0000000A), ref: 00ACDBB1

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 28335361ff08167180cc1d12ca684e4d245edf7b8d788d2a686e85c911fe25a6
Instruction ID: 80ada04a77d69e5400430f6a6381c1324299a9ec22a140fa0c6414af7b14e419
Opcode Fuzzy Hash: 28335361ff08167180cc1d12ca684e4d245edf7b8d788d2a686e85c911fe25a6
Instruction Fuzzy Hash: 5742C230608341EFD729CF24C885FAAB7E1FF45304F5589AEE55687291DB70E894CB92

Function 00AC2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AC2D07
RegisterClassExW.USER32(00000030), ref: 00AC2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AC2D42
InitCommonControlsEx.COMCTL32(?), ref: 00AC2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AC2D6F
LoadIconW.USER32(000000A9), ref: 00AC2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AC2D94

Strings

0, xrefs: 00AC2CE9
+, xrefs: 00AC2CF0
AutoIt v3 GUI, xrefs: 00AC2D23
TaskbarCreated, xrefs: 00AC2D37

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 94efa0403f5cbb1a12121496ab9fa2a53c1490967e5427e4c4538f13ea7293d1
Instruction ID: 9c55e9e07e9ab767d824c2b8d3932ee0c0a2059faeed4d578d9d7e4735019e58
Opcode Fuzzy Hash: 94efa0403f5cbb1a12121496ab9fa2a53c1490967e5427e4c4538f13ea7293d1
Instruction Fuzzy Hash: BD21E2B1901309AFDB00DFA8ED49B9DBFB9FB08701F00455AE911A72A0DBB14544DF94

Function 00B0065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0039A: CreateFileW.KERNELBASE(00000000,00000000,?,00B00704,?,?,00000000,?,00B00704,00000000,0000000C), ref: 00B003B7

GetLastError.KERNEL32 ref: 00B0076F
__dosmaperr.LIBCMT ref: 00B00776
GetFileType.KERNELBASE(00000000), ref: 00B00782
GetLastError.KERNEL32 ref: 00B0078C
__dosmaperr.LIBCMT ref: 00B00795
CloseHandle.KERNEL32(00000000), ref: 00B007B5
CloseHandle.KERNEL32(?), ref: 00B008FF
GetLastError.KERNEL32 ref: 00B00931
__dosmaperr.LIBCMT ref: 00B00938

Strings

H, xrefs: 00B008BD

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 562128a1a84bca18851499f08af13c32b2b1cf3294f297fd361e8a5082fb94cf
Instruction ID: cdb0fd06cb43f717f67c2102ef9527cd16eb086a1f863de752010070deaef3de
Opcode Fuzzy Hash: 562128a1a84bca18851499f08af13c32b2b1cf3294f297fd361e8a5082fb94cf
Instruction Fuzzy Hash: DBA10732A242488FDF19BF68D891BAD7FE1EB06320F14419AF8159B2D1DB359D12CB91

Function 00AC344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AC3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00B91418,?,00AC2E7F,?,?,?,00000000), ref: 00AC3A78

Part of subcall function 00AC3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00AC3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00AC356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00B0318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00B031CE
RegCloseKey.ADVAPI32(?), ref: 00B03210
_wcslen.LIBCMT ref: 00B03277
_wcslen.LIBCMT ref: 00B03286

Strings

\, xrefs: 00B0328C
Software\AutoIt v3\AutoIt, xrefs: 00AC3560
\Include\, xrefs: 00AC3527
Include, xrefs: 00B03184, 00B031C5

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 9132fb1daee4a8c4078b4d1f6dc107f16e6a4ec771afdddcfe401c1b12ad2640
Instruction ID: 074fab088e94687dc9a5592ef3c45294406bc3d5fca234f004288e38e6363852
Opcode Fuzzy Hash: 9132fb1daee4a8c4078b4d1f6dc107f16e6a4ec771afdddcfe401c1b12ad2640
Instruction Fuzzy Hash: B571A271809301AEC704EF25DE86EABBBE8FF89740F41456EF545932A1DF309A48CB56

Function 00AC2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AC2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00AC2B9D
LoadIconW.USER32(00000063), ref: 00AC2BB3
LoadIconW.USER32(000000A4), ref: 00AC2BC5
LoadIconW.USER32(000000A2), ref: 00AC2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00AC2BEF
RegisterClassExW.USER32(?), ref: 00AC2C40

Part of subcall function 00AC2CD4: GetSysColorBrush.USER32(0000000F), ref: 00AC2D07
Part of subcall function 00AC2CD4: RegisterClassExW.USER32(00000030), ref: 00AC2D31
Part of subcall function 00AC2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AC2D42
Part of subcall function 00AC2CD4: InitCommonControlsEx.COMCTL32(?), ref: 00AC2D5F
Part of subcall function 00AC2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AC2D6F
Part of subcall function 00AC2CD4: LoadIconW.USER32(000000A9), ref: 00AC2D85
Part of subcall function 00AC2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AC2D94

Strings

AutoIt v3, xrefs: 00AC2C2F
0, xrefs: 00AC2C0F
#, xrefs: 00AC2C16

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 844efa06065c40776e41ae604e5d492ad75f1b536f7ff846b59fd156592cd9d1
Instruction ID: 136997400d7f783d3b58a67edced172963a213cd385c5618cbe19c4789c4005f
Opcode Fuzzy Hash: 844efa06065c40776e41ae604e5d492ad75f1b536f7ff846b59fd156592cd9d1
Instruction Fuzzy Hash: 6B212571A04319BFDB10DFA9EE45BA97FB5FB08B50F00055BE504A76A0DBB10940EF98

Function 00AC3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00AC316A,?,?), ref: 00AC31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00AC316A,?,?), ref: 00AC3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00AC3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00AC316A,?,?), ref: 00AC3232
CreatePopupMenu.USER32 ref: 00AC3246
PostQuitMessage.USER32(00000000), ref: 00AC3267

Strings

TaskbarCreated, xrefs: 00AC322D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 0a583b5afcbb92de6982456d1cee4806fe38b13bb5c624cd281e6ac516087709
Instruction ID: 209353c2a57b69641ff3128019f3d26c71324ee200170e67ce23fb4ec6cd71bd
Opcode Fuzzy Hash: 0a583b5afcbb92de6982456d1cee4806fe38b13bb5c624cd281e6ac516087709
Instruction Fuzzy Hash: 77411833244201AEDF151F3C9E0DFB93EA5E719340F0986AEF50287292CF618E41AB61

Function 00AC2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00AC2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00AC2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00AC1CAD,?), ref: 00AC2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00AC1CAD,?), ref: 00AC2CCF

Strings

AutoIt v3, xrefs: 00AC2C89, 00AC2C8E, 00AC2C8F
edit, xrefs: 00AC2CAC

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 799d5feec06e1bafa21cee75ee172673a903cba3757205803b0c72a5b82a1ca7
Instruction ID: 5e9c86312438d6b8459be307ba8c33ef315230152ef983e23aff149867b88c09
Opcode Fuzzy Hash: 799d5feec06e1bafa21cee75ee172673a903cba3757205803b0c72a5b82a1ca7
Instruction Fuzzy Hash: F7F0DA755443917EEB311B2BAD08F772EBED7CAF51F00049AF904A35A0CA711854EAB8

Function 00B2E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00B2E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00B2E9A5
Sleep.KERNEL32(00000000), ref: 00B2E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00B2E9B7
Sleep.KERNELBASE ref: 00B2E9F3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 03241fbc61374a5d479dee76175ac7840d545e70eeb10854eb9a3d25269e117c
Instruction ID: e8dd3fd3c5810686ec898b44dd17a819471e1e7591b385af37068ff6b49eab7e
Opcode Fuzzy Hash: 03241fbc61374a5d479dee76175ac7840d545e70eeb10854eb9a3d25269e117c
Instruction Fuzzy Hash: 18011731C01A39DBCF00ABE6E859AEDBBB9FB09701F000596E516B2241DB349594CBA1

Function 00AC3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00AC3B0F,SwapMouseButtons,00000004,?), ref: 00AC3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00AC3B0F,SwapMouseButtons,00000004,?), ref: 00AC3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00AC3B0F,SwapMouseButtons,00000004,?), ref: 00AC3B83

Strings

Control Panel\Mouse, xrefs: 00AC3B3E

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: df6765be46eb4fba3898bda2765042485952ad46f4a353f74cfa6699b6bbc0ad
Instruction ID: d64980947d4d262978344bd5e8febbc71151dd337bd39a8aed9c4fd02cc60476
Opcode Fuzzy Hash: df6765be46eb4fba3898bda2765042485952ad46f4a353f74cfa6699b6bbc0ad
Instruction Fuzzy Hash: 71112AB6510208FFDF218FA5DC44EEFBBB8EF04755B118459B806D7110D6719E409B60

Function 00AC3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00B033A2

Part of subcall function 00AC6B57: _wcslen.LIBCMT ref: 00AC6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00AC3A04

Strings

Line: , xrefs: 00B033EB

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: fe53c838a977d35b67bbd863c8d73adbd5d3041b98236b3eb283f0d7d68cbc23
Instruction ID: 93e128289780d5e3208ed1bd61eab5ee3c8b5afde55927523d59c68c47a08e7c
Opcode Fuzzy Hash: fe53c838a977d35b67bbd863c8d73adbd5d3041b98236b3eb283f0d7d68cbc23
Instruction Fuzzy Hash: 3031D272408301AADB21EB24DD46FEBB7ECAB44710F11896EF59A93191DF709A48C7C6

Function 00ADFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00AE0668

Part of subcall function 00AE32A4: RaiseException.KERNEL32(?,?,?,00AE068A,?,00B91444,?,?,?,?,?,?,00AE068A,00AC1129,00B88738,00AC1129), ref: 00AE3304

__CxxThrowException@8.LIBVCRUNTIME ref: 00AE0685

Strings

Unknown exception, xrefs: 00AE0692

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 14b48b1420ec5beee3687d5fd0f56c4c6cf4974a3eb047b889972039159f221b
Instruction ID: fcab1d4487053cb0152acbce6ce0d1180cfe54c09b24fdbff629615ba0624d50
Opcode Fuzzy Hash: 14b48b1420ec5beee3687d5fd0f56c4c6cf4974a3eb047b889972039159f221b
Instruction Fuzzy Hash: 46F0463490038D7BCF00B766D84AE9E77BD5E00300BA04071B965D65E1EFB0DAA5CAC0

Function 00AC10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AC1BF4
Part of subcall function 00AC1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00AC1BFC
Part of subcall function 00AC1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AC1C07
Part of subcall function 00AC1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AC1C12
Part of subcall function 00AC1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00AC1C1A
Part of subcall function 00AC1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00AC1C22

Part of subcall function 00AC1B4A: RegisterWindowMessageW.USER32(00000004,?,00AC12C4), ref: 00AC1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00AC136A
OleInitialize.OLE32 ref: 00AC1388
CloseHandle.KERNEL32(00000000,00000000), ref: 00B024AB

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 38a786f8e635a0c67af75dc80f930a192a5c0a581e2d307d054cffa5a29b75c1
Instruction ID: 0de6251dd4f39da59e8034ca1f057aae2964de88f0568618d62ca587e1c7b3d9
Opcode Fuzzy Hash: 38a786f8e635a0c67af75dc80f930a192a5c0a581e2d307d054cffa5a29b75c1
Instruction Fuzzy Hash: 5A71EDB59113028FC785DF7DAB85A543AE1BBA93447138AAFD41AC7361EF304801EF50

Function 00B2C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00AC3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00B2C259
KillTimer.USER32(?,00000001,?,?), ref: 00B2C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B2C270

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: a6d8818ec1d4ef238ff0bbbdebec69789207b95966d654248cadb9f9f319ee23
Instruction ID: 7422931741f114fb89971c555cb9dc225fe7e4c8ca8236303a9741dd9067a86c
Opcode Fuzzy Hash: a6d8818ec1d4ef238ff0bbbdebec69789207b95966d654248cadb9f9f319ee23
Instruction Fuzzy Hash: 6F318170904364AFEB22DF649895BEABFECDB06348F0044DAD59EA7241CB745A84CB51

Function 00AF86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00AF85CC,?,00B88CC8,0000000C), ref: 00AF8704
GetLastError.KERNEL32(?,00AF85CC,?,00B88CC8,0000000C), ref: 00AF870E
__dosmaperr.LIBCMT ref: 00AF8739

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 46fb2ca1a32c0b10c69bb8a33eb88f60149f59819a60897cbd4d0adfae28878c
Instruction ID: 3ac21245ecbbacf1852f91d430dd94f17eaa5752420755d289dce147b663b306
Opcode Fuzzy Hash: 46fb2ca1a32c0b10c69bb8a33eb88f60149f59819a60897cbd4d0adfae28878c
Instruction Fuzzy Hash: 1A018233A0562C1AC27073F4694977E6B854B83779F350219FB04CF0D2DE78CC818150

Function 00ACDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00ACDB7B
DispatchMessageW.USER32(?), ref: 00ACDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00ACDB9F
Sleep.KERNELBASE(0000000A), ref: 00ACDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00B11CC9

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 92b9fcb2bdf0ce210ab71b748f89a27db5f5a69050cda0dfde179c1d489dc78d
Instruction ID: 2640141e8cf4caec92d3474bb7dcc0d9fbdad865789c8dc1f16ea5c4bce49427
Opcode Fuzzy Hash: 92b9fcb2bdf0ce210ab71b748f89a27db5f5a69050cda0dfde179c1d489dc78d
Instruction Fuzzy Hash: 59F05E306443419BEB30DBA4DC89FEA77E9EB88311F504969E65A870C0EF3098889B65

Function 00AD1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00AD17F6

Strings

CALL, xrefs: 00AD17C6

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: a2b3f6586801eb32c819e087f08f31134b57cf2146b7632d952d5bcbd4deba22
Instruction ID: dfd4fdde225b45439180f6ce4fa3ceb424e96d4ec7865ac8973d9f42349ae429
Opcode Fuzzy Hash: a2b3f6586801eb32c819e087f08f31134b57cf2146b7632d952d5bcbd4deba22
Instruction Fuzzy Hash: 92228AB0608201AFC714CF14D490B6ABBF2BF99314F64896EF4978B361D735E985CB92

Function 00AC2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00B02C8C

Part of subcall function 00AC3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AC3A97,?,?,00AC2E7F,?,?,?,00000000), ref: 00AC3AC2

Part of subcall function 00AC2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00AC2DC4

Strings

X, xrefs: 00B02C5A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: a460b511dad1a99468ae56df037b7cde32b67d7e9591555fbc2b102d95803913
Instruction ID: 239420189b5f9f7fce29ef670ba7d1abf02f390a739073c53b29a1fd86f25e4e
Opcode Fuzzy Hash: a460b511dad1a99468ae56df037b7cde32b67d7e9591555fbc2b102d95803913
Instruction Fuzzy Hash: 95219371A102589FDF01EF98C949BEE7BF8AF48314F008059E505BB281DBB45A89CF61

Function 00AC3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AC3908

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: a706fa1830381b2e3d91f7d8ebdbf9c585f2954922c0fee7c500f9c3c7543e5e
Instruction ID: dddd40eb507e209cb0731b375a5351be34cbdc66e76a8b20a8aba64cf427871c
Opcode Fuzzy Hash: a706fa1830381b2e3d91f7d8ebdbf9c585f2954922c0fee7c500f9c3c7543e5e
Instruction Fuzzy Hash: F8319171504301DFE720DF24D985BABBBF8FB49708F00096EF59A87240EB71AA44CB56

Function 00ADF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00ADF661

Part of subcall function 00ACD730: GetInputState.USER32 ref: 00ACD807

Sleep.KERNEL32(00000000), ref: 00B1F2DE

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 31d58ed63b779e7d4fecca27f3f03a7a9e384e1564bc362b7000a36b3595bcd4
Instruction ID: b165ccaf73d2ed411eff6e017f3dd3a2c1dc38fa22f7b829e43ffbc47a63fba7
Opcode Fuzzy Hash: 31d58ed63b779e7d4fecca27f3f03a7a9e384e1564bc362b7000a36b3595bcd4
Instruction Fuzzy Hash: 7DF08C352407059FD310EF69D54AF6ABBE9EF59761F00006AE85AC7361DB70A800CBA0

Function 00ACB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00ACBB4E

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 245916710e4efbddeba466831d8c3f6b87aba317ad7d9fff1bbbd6a97600d88f
Instruction ID: 9c14a73fbd0ce74c8cee0756fb812f97d497a2b4201cca6123742c298ac745de
Opcode Fuzzy Hash: 245916710e4efbddeba466831d8c3f6b87aba317ad7d9fff1bbbd6a97600d88f
Instruction Fuzzy Hash: B232CF34A10209EFCB10DF54C985FBAB7F9EF44300F568099E915AB261C7B6AD81CBA1

Function 00B52598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00B52649

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 18e7c0a272bd4b078693f950da649f0dc91b6d9b9cb19b03534d17661cd0198c
Instruction ID: c460e79f860a04fd8989eca4663d116ab58d63034c25439f0ba2d95dd2491156
Opcode Fuzzy Hash: 18e7c0a272bd4b078693f950da649f0dc91b6d9b9cb19b03534d17661cd0198c
Instruction Fuzzy Hash: F721D074201219AFE710DF14C8D0E36B7D9EB56369B1080ECEC568B392CB31ED45CB90

Function 00B513B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00B51420

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 7467bae4d277bd1bec4a4405cfdfa2b0b376e95df468354c16d29dd7d650d700
Instruction ID: 29d5c71eafcddec3dc78e3672f5d0b3e126384dfdd331c03a08181aeed43cb03
Opcode Fuzzy Hash: 7467bae4d277bd1bec4a4405cfdfa2b0b376e95df468354c16d29dd7d650d700
Instruction Fuzzy Hash: 7C314770604202AFD714EF29C491B69B7E2FB4532AF0486E9E81A4B392DB35EC45CB90

Function 00AC4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AC4EDD,?,00B91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AC4E9C
Part of subcall function 00AC4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00AC4EAE
Part of subcall function 00AC4E90: FreeLibrary.KERNEL32(00000000,?,?,00AC4EDD,?,00B91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AC4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00B91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AC4EFD

Part of subcall function 00AC4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B03CDE,?,00B91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AC4E62
Part of subcall function 00AC4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00AC4E74
Part of subcall function 00AC4E59: FreeLibrary.KERNEL32(00000000,?,?,00B03CDE,?,00B91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AC4E87

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: d03cee980a5bfdbb13865603909e1a4ac69e513bc7401ee6a852bd61db10c572
Instruction ID: 492e0fa192afb87ff2c491da7d368093c61b822c80ac027a9a5b66804f1310d4
Opcode Fuzzy Hash: d03cee980a5bfdbb13865603909e1a4ac69e513bc7401ee6a852bd61db10c572
Instruction Fuzzy Hash: DD113A31600305AADF24FF74DD16FED77E59F44B10F21442DF442A61D1EEB0AA449794

Function 00AF8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00AF8440

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 7ee1628246c180f40d12ca269f9014e16ed70c279425156cb66aa48e707e9a46
Instruction ID: 367db8718a01838756f3c90772fc66f008ba6521968fadc913c1d75b31abc3cc
Opcode Fuzzy Hash: 7ee1628246c180f40d12ca269f9014e16ed70c279425156cb66aa48e707e9a46
Instruction Fuzzy Hash: 0F11187590410AAFCB05DF98E9419AE7BF5EF48314F144199F908AB312DB31DA11CBA5

Function 00AF5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AF4C7D: RtlAllocateHeap.NTDLL(00000008,00AC1129,00000000,?,00AF2E29,00000001,00000364,?,?,?,00AEF2DE,00AF3863,00B91444,?,00ADFDF5,?), ref: 00AF4CBE

_free.LIBCMT ref: 00AF506C

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: b921085c5db105922849fd3056edf8ee8f3f80efe16874cdca7cd549485968fc
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 61012B726047095FE3218FA5D881A6AFBE8FB89370F25052DF39483280EB706905C774

Function 00B529BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00B514B5,?), ref: 00B52A01

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 5a9c646bc38973baa5d2942f04a12c93d9fcc801fbcada7d0e45e2f813a84b7c
Instruction ID: e9ed1919053482949ab11d60f2c2b87754d94b780182111fb6817c316bfacc17
Opcode Fuzzy Hash: 5a9c646bc38973baa5d2942f04a12c93d9fcc801fbcada7d0e45e2f813a84b7c
Instruction Fuzzy Hash: BC01B5363016819FE325CB2CC494B2237D2EBCA316F2984E8C4478B251DB32EC46C790

Function 00AEE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 419cd18a2e301eec6792e615d8185ea9f70a67c761b263b4f13c429125500a59
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 5BF02832511E589BDB317BBB9E05B6B33989F92374F100B15F620931D2DF74D80186A5

Function 00B5149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 00B514EB

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: b7601e11d35c8329ddea2dcb13c0b4dcd93739a697f3d657633ccb63dda75453
Instruction ID: a13dff06a5684f5cc68f77985fb917cbd3e3bca8f17d4a6e83e49d26f8152327
Opcode Fuzzy Hash: b7601e11d35c8329ddea2dcb13c0b4dcd93739a697f3d657633ccb63dda75453
Instruction Fuzzy Hash: C301BC352097419FA720DF6ED480A26BBD5EB8932575484EDEC4A8B702D632DD86CB80

Function 00AF4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00AC1129,00000000,?,00AF2E29,00000001,00000364,?,?,?,00AEF2DE,00AF3863,00B91444,?,00ADFDF5,?), ref: 00AF4CBE

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d7fd4ffc1031daab2bdaa3e8bfecea418aa93727a75ec61de82f98ebdf62520f
Instruction ID: e2714328f83d0e8b287621043310dcd9ce9201119464701b1ff71c48076aef2c
Opcode Fuzzy Hash: d7fd4ffc1031daab2bdaa3e8bfecea418aa93727a75ec61de82f98ebdf62520f
Instruction Fuzzy Hash: 3EF0243120636866DB201FA3AD04B7B3798AF497A0B145111BB15A7281CE30D80292A0

Function 00AF3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00B91444,?,00ADFDF5,?,?,00ACA976,00000010,00B91440,00AC13FC,?,00AC13C6,?,00AC1129), ref: 00AF3852

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1edfa7ea86953263de98b750971c074fc4c2f54927e14030781e41a4952a2b1d
Instruction ID: c1c190346e7eec08d665cc85ee634cbe2f936e1ecf340b0a098c982759ed0efd
Opcode Fuzzy Hash: 1edfa7ea86953263de98b750971c074fc4c2f54927e14030781e41a4952a2b1d
Instruction Fuzzy Hash: 1EE0A033102368AADF312BF79E00BAA3659AB42BF0F150021BE0493580DB199D0191E0

Function 00AC4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00B91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AC4F6D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d5c463531c4a49564ad1c4261df54c7a23c81e267b9e6bc1d5d3a7573a77d48c
Instruction ID: 4c04af7e3b104a3aa1a8447953c3fe9291cdf89814ef1290e796b47f0267d7ac
Opcode Fuzzy Hash: d5c463531c4a49564ad1c4261df54c7a23c81e267b9e6bc1d5d3a7573a77d48c
Instruction Fuzzy Hash: E2F03971105752CFDB349F64D5A0E22BBF5AF18729321897EE1EA83621CB319844DF94

Function 00B52A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00B52A66

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: b40604be3f5bbef11b8d458623eae507d5295788c1df4741686ed68a214b49e7
Instruction ID: 85b2fab324dceeb8dd7179b2746aab4a6a1ba1a59e6b5a5ad7166d44cb15c82f
Opcode Fuzzy Hash: b40604be3f5bbef11b8d458623eae507d5295788c1df4741686ed68a214b49e7
Instruction Fuzzy Hash: EEE0DF32341226AAD710EB30EC80AFA77CCEB11392B1045F6EC1AC2100DF348A9986A0

Function 00AC2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00AC2DC4

Part of subcall function 00AC6B57: _wcslen.LIBCMT ref: 00AC6B6A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 95cc7f6986c95d3098626e582e59bdb4cfd441617cf7d541cb399a03845b455c
Instruction ID: fcaf6b60ec27a352ccf3f78b1602cf9fb7d7609aa8304ea90cf427d52a355aea
Opcode Fuzzy Hash: 95cc7f6986c95d3098626e582e59bdb4cfd441617cf7d541cb399a03845b455c
Instruction Fuzzy Hash: CEE0C272A002245BCB21E6989C06FEA7BEDDFC8790F0500B5FD09E7248DE60AD808690

Function 00AC2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00AC3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AC3908

Part of subcall function 00ACD730: GetInputState.USER32 ref: 00ACD807

SetCurrentDirectoryW.KERNEL32(?), ref: 00AC2B6B

Part of subcall function 00AC30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00AC314E

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: c7d830630db9b4f518a9bf724e3e755b5d825073c789b27afe3f95210d117b1f
Instruction ID: fea6a73d0c7b8595cdcd89c52899bd0682c3e52bff5525d003d8925c9dd2b48e
Opcode Fuzzy Hash: c7d830630db9b4f518a9bf724e3e755b5d825073c789b27afe3f95210d117b1f
Instruction Fuzzy Hash: 8AE0862370434507CE04BB789A56F7DB7999BD5351F42597EF14243262CE2449464752

Function 00B23D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B23D18

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 98a41d0860e431991d8a6f3eda690ae53e3019556bea63473ff2067dcb291139
Instruction ID: 42a9b6a400416246306e50ebb063a852b99c7a0bd0f2c4852143f07c2c7de575
Opcode Fuzzy Hash: 98a41d0860e431991d8a6f3eda690ae53e3019556bea63473ff2067dcb291139
Instruction Fuzzy Hash: C2D012E06A03087EFB0083718C0BEBB369CC316A82F104BA47A02D74C1D9A0DE080130

Function 00B0039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00B00704,?,?,00000000,?,00B00704,00000000,0000000C), ref: 00B003B7

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 69ad0d1482763414786389e13fdc52f985e8b1ae552b13cc628dfdbc375cb258
Instruction ID: 1f41c82bd0a8d51cdfa6719d57b6afc8663c599635347566609904717c718529
Opcode Fuzzy Hash: 69ad0d1482763414786389e13fdc52f985e8b1ae552b13cc628dfdbc375cb258
Instruction Fuzzy Hash: AAD06C3204020DBFDF028F84DD06EDA3FAAFB48714F014040BE1866020C732E821AB90

Function 00AC1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00AC1CBC

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: ecd177ed8a9c6f50e0d9c1af60b22a7a68e4d71e5cdca5145da82d0e3cf29b83
Instruction ID: b0d983645f2de4b02ff8eac19803e2c06b3a125269594079959c3a92aab08ae9
Opcode Fuzzy Hash: ecd177ed8a9c6f50e0d9c1af60b22a7a68e4d71e5cdca5145da82d0e3cf29b83
Instruction Fuzzy Hash: 3BC09B35280305BFF21447D4BD4BF107765A358B01F444402F60D575E3DBB11810E654

Non-executed Functions

Function 00B59576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AD9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00B5961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B5965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00B5969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B596C9
SendMessageW.USER32 ref: 00B596F2
GetKeyState.USER32(00000011), ref: 00B5978B
GetKeyState.USER32(00000009), ref: 00B59798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B597AE
GetKeyState.USER32(00000010), ref: 00B597B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B597E9
SendMessageW.USER32 ref: 00B59810
SendMessageW.USER32(?,00001030,?,00B57E95), ref: 00B59918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00B5992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00B59941
SetCapture.USER32(?), ref: 00B5994A
ClientToScreen.USER32(?,?), ref: 00B599AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00B599BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B599D6
ReleaseCapture.USER32 ref: 00B599E1
GetCursorPos.USER32(?), ref: 00B59A19
ScreenToClient.USER32(?,?), ref: 00B59A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00B59A80
SendMessageW.USER32 ref: 00B59AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00B59AEB
SendMessageW.USER32 ref: 00B59B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00B59B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00B59B4A
GetCursorPos.USER32(?), ref: 00B59B68
ScreenToClient.USER32(?,?), ref: 00B59B75
GetParent.USER32(?), ref: 00B59B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00B59BFA
SendMessageW.USER32 ref: 00B59C2B
ClientToScreen.USER32(?,?), ref: 00B59C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00B59CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00B59CDE
SendMessageW.USER32 ref: 00B59D01
ClientToScreen.USER32(?,?), ref: 00B59D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00B59D82

Part of subcall function 00AD9944: GetWindowLongW.USER32(?,000000EB), ref: 00AD9952

GetWindowLongW.USER32(?,000000F0), ref: 00B59E05

Strings

F, xrefs: 00B59D07
@GUI_DRAGID, xrefs: 00B5997D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 1a0f8e329ce420f1153b4418d8fb27649e5c3b0cc4c0230587eaabdb6846e109
Instruction ID: 61c6d501da846278e3dc9955dafe157282abcfbbe4331150c29983d93d4fb25d
Opcode Fuzzy Hash: 1a0f8e329ce420f1153b4418d8fb27649e5c3b0cc4c0230587eaabdb6846e109
Instruction Fuzzy Hash: 23427B30204301EFDB21CF28CD84BAABBE5FF49311F140A99FA59872A1DB31A959DF51

Function 00B54873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00B548F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00B54908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00B54927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00B5494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00B5495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00B5497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00B549AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00B549D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00B54A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00B54A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00B54A7E
IsMenu.USER32(?), ref: 00B54A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B54AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B54B20
GetWindowLongW.USER32(?,000000F0), ref: 00B54B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00B54BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00B54C82
wsprintfW.USER32 ref: 00B54CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B54CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00B54CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00B54D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B54D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00B54D5A

Strings

%d/%02d/%02d, xrefs: 00B54CA8

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 5465d147aba2acc000d64d2136970e94b8755d70942a288e0b0b4ef8566111b0
Instruction ID: 22a4e7c5f0a422c778776dadfb1f302139ece65a5da23cc3574cc9113eac64a7
Opcode Fuzzy Hash: 5465d147aba2acc000d64d2136970e94b8755d70942a288e0b0b4ef8566111b0
Instruction Fuzzy Hash: 8612DE31500344AFEB258F28CC49FAE7BF8EB45315F1041A9F91ADB2E1DB749A85CB50

Function 00B21201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00B216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B2170D
Part of subcall function 00B216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B2173A
Part of subcall function 00B216C3: GetLastError.KERNEL32 ref: 00B2174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00B21286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00B212A8
CloseHandle.KERNEL32(?), ref: 00B212B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00B212D1
GetProcessWindowStation.USER32 ref: 00B212EA
SetProcessWindowStation.USER32(00000000), ref: 00B212F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00B21310

Part of subcall function 00B210BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B211FC), ref: 00B210D4
Part of subcall function 00B210BF: CloseHandle.KERNEL32(?,?,00B211FC), ref: 00B210E9

Strings

winsta0, xrefs: 00B212CC
, xrefs: 00B2125A
default, xrefs: 00B2130B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 7cb83ed70f51ad0e68aa09f9ed084d8d7fc03aa55be617ca04d2a14783e6595e
Instruction ID: 92839b5c21930bd2dad54826e54cdc1333b7ec2e49b1e5ab1074117fe3923d44
Opcode Fuzzy Hash: 7cb83ed70f51ad0e68aa09f9ed084d8d7fc03aa55be617ca04d2a14783e6595e
Instruction Fuzzy Hash: D7818F71900358AFDF10AFA8EC49BEE7BB9EF04700F144599F929B62A0CB318945CF20

Function 00B20B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B21114
Part of subcall function 00B210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00B20B9B,?,?,?), ref: 00B21120
Part of subcall function 00B210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B20B9B,?,?,?), ref: 00B2112F
Part of subcall function 00B210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B20B9B,?,?,?), ref: 00B21136
Part of subcall function 00B210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B2114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B20BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B20C00
GetLengthSid.ADVAPI32(?), ref: 00B20C17
GetAce.ADVAPI32(?,00000000,?), ref: 00B20C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B20C6D
GetLengthSid.ADVAPI32(?), ref: 00B20C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00B20C8C
HeapAlloc.KERNEL32(00000000), ref: 00B20C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B20CB4
CopySid.ADVAPI32(00000000), ref: 00B20CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B20CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B20D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B20D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B20D45
HeapFree.KERNEL32(00000000), ref: 00B20D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B20D55
HeapFree.KERNEL32(00000000), ref: 00B20D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B20D65
HeapFree.KERNEL32(00000000), ref: 00B20D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00B20D78
HeapFree.KERNEL32(00000000), ref: 00B20D7F

Part of subcall function 00B21193: GetProcessHeap.KERNEL32(00000008,00B20BB1,?,00000000,?,00B20BB1,?), ref: 00B211A1
Part of subcall function 00B21193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00B20BB1,?), ref: 00B211A8
Part of subcall function 00B21193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00B20BB1,?), ref: 00B211B7

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c325f5d239ce7d339b93c79985485580c7f3d7501b3abbc24637b1eb629662d5
Instruction ID: 6390279c4a4c2471a782b844fe81c0b416bfecec3e5d7ecf8f027d4e920735ae
Opcode Fuzzy Hash: c325f5d239ce7d339b93c79985485580c7f3d7501b3abbc24637b1eb629662d5
Instruction Fuzzy Hash: 0A718C7190031AAFDF10AFA4EC44BAEBBF9FF04341F1445A5E918A7192DB70A905CF60

Function 00B3EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00B5CC08), ref: 00B3EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00B3EB37
GetClipboardData.USER32(0000000D), ref: 00B3EB43
CloseClipboard.USER32 ref: 00B3EB4F
GlobalLock.KERNEL32(00000000), ref: 00B3EB87
CloseClipboard.USER32 ref: 00B3EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00B3EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00B3EBC9
GetClipboardData.USER32(00000001), ref: 00B3EBD1
GlobalLock.KERNEL32(00000000), ref: 00B3EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00B3EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00B3EC38
GetClipboardData.USER32(0000000F), ref: 00B3EC44
GlobalLock.KERNEL32(00000000), ref: 00B3EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00B3EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00B3EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00B3ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00B3ECF3
CountClipboardFormats.USER32 ref: 00B3ED14
CloseClipboard.USER32 ref: 00B3ED59

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 239934c604fb9e8ae2d931f8321443cbddfbfb9734de29c95fac3f55dab99460
Instruction ID: fb326d7916b1bc2f909e76c65a3c4c5461c6ba582f15cadef101f0ba46ce3031
Opcode Fuzzy Hash: 239934c604fb9e8ae2d931f8321443cbddfbfb9734de29c95fac3f55dab99460
Instruction Fuzzy Hash: 0A618934204301AFD301EF24D899F6ABBE5EB84704F24459EF4669B2E2DF31E905CB62

Function 00B3698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B369BE
FindClose.KERNEL32(00000000), ref: 00B36A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B36A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B36A75

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00B36AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00B36ADF

Strings

%4d, xrefs: 00B36BB1
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00B36B32
%02d, xrefs: 00B36C00, 00B36C0A, 00B36C5A, 00B36CAA, 00B36CFA, 00B36D4A
%4d%02d%02d%02d%02d%02d, xrefs: 00B36B6A
%03d, xrefs: 00B36DA2

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 61d81cd89a0e69e7320aada5070c3179be495b59a576f11698614dc2e776e616
Instruction ID: 97519de9806015c1ef9d1cf2ce6e6569e1f73bcc76454ad376a3705cb6767daf
Opcode Fuzzy Hash: 61d81cd89a0e69e7320aada5070c3179be495b59a576f11698614dc2e776e616
Instruction Fuzzy Hash: F1D14072508300AFC714EBA4C986EAFB7ECAF88704F04495DF589D7191EB74DA44CB62

Function 00B39642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00B39663
GetFileAttributesW.KERNEL32(?), ref: 00B396A1
SetFileAttributesW.KERNEL32(?,?), ref: 00B396BB
FindNextFileW.KERNEL32(00000000,?), ref: 00B396D3
FindClose.KERNEL32(00000000), ref: 00B396DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00B396FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00B3974A
SetCurrentDirectoryW.KERNEL32(00B86B7C), ref: 00B39768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B39772
FindClose.KERNEL32(00000000), ref: 00B3977F
FindClose.KERNEL32(00000000), ref: 00B3978F

Strings

*.*, xrefs: 00B396F5

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: d10822122d6f0fd2d6b0250dc9b72f26d9809d5f2274136107701ebeb0d27ad6
Instruction ID: 944a4d1eedde6098a6a08e1fa649287f12e83990f2ef3a71eb1e65d7feb180c5
Opcode Fuzzy Hash: d10822122d6f0fd2d6b0250dc9b72f26d9809d5f2274136107701ebeb0d27ad6
Instruction Fuzzy Hash: 1731BF3254131AAEDB14AFB4EC49ADE7BECDF09321F2041D5E915E30A0DB75DD44CA54

Function 00B3979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00B397BE
FindNextFileW.KERNEL32(00000000,?), ref: 00B39819
FindClose.KERNEL32(00000000), ref: 00B39824
FindFirstFileW.KERNEL32(*.*,?), ref: 00B39840
SetCurrentDirectoryW.KERNEL32(?), ref: 00B39890
SetCurrentDirectoryW.KERNEL32(00B86B7C), ref: 00B398AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B398B8
FindClose.KERNEL32(00000000), ref: 00B398C5
FindClose.KERNEL32(00000000), ref: 00B398D5

Part of subcall function 00B2DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00B2DB00

Strings

*.*, xrefs: 00B3983B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: e778df8c67978b4b00d714f5ac353ddf30d7e052ec51d53ce2e01ddd5f2edd6d
Instruction ID: f80aef2e5c38b23f16c41dd4f90858d2817fea09c0acb3ba06ad8c64598ef3cf
Opcode Fuzzy Hash: e778df8c67978b4b00d714f5ac353ddf30d7e052ec51d53ce2e01ddd5f2edd6d
Instruction Fuzzy Hash: 4431CE3250031AAEDB10AFB4EC49ADE77ECDF46365F2041E5E910A30E0DBB1DE84CA64

Function 00B4BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B4B6AE,?,?), ref: 00B4C9B5
Part of subcall function 00B4C998: _wcslen.LIBCMT ref: 00B4C9F1
Part of subcall function 00B4C998: _wcslen.LIBCMT ref: 00B4CA68
Part of subcall function 00B4C998: _wcslen.LIBCMT ref: 00B4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B4BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00B4BFA9
RegCloseKey.ADVAPI32(00000000), ref: 00B4BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B4C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00B4C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00B4C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00B4C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00B4C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00B4C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B4C382
RegCloseKey.ADVAPI32(00000000), ref: 00B4C38F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 907afb5ed194e12459f4cbc662de690616fc602fa7ad1489b91754942e344b57
Instruction ID: b41ee2f06e97472b86949248a5479cd2fdae34c476a119c32e7fa618428b09aa
Opcode Fuzzy Hash: 907afb5ed194e12459f4cbc662de690616fc602fa7ad1489b91754942e344b57
Instruction Fuzzy Hash: 93026C70604200AFC754CF28C895E2ABBE5EF89718F19C49DF84ADB2A2DB31ED45DB51

Function 00B38195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00B38257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00B38267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00B38273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B38310
SetCurrentDirectoryW.KERNEL32(?), ref: 00B38324
SetCurrentDirectoryW.KERNEL32(?), ref: 00B38356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00B3838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00B38395

Strings

*.*, xrefs: 00B3839B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 4c4f713c0a72dfa04873ab0aa279893bde7dbb4792e548ad454b25cc5e02757e
Instruction ID: 39df9cc57e14f04cffccc810b6db81374ecf0e1af05f1d1244692945d91acf28
Opcode Fuzzy Hash: 4c4f713c0a72dfa04873ab0aa279893bde7dbb4792e548ad454b25cc5e02757e
Instruction Fuzzy Hash: C06158725043459FCB10EF60C881AAFB3E8FF89314F14896EF99997251DB31E945CB92

Function 00B2D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AC3A97,?,?,00AC2E7F,?,?,?,00000000), ref: 00AC3AC2

Part of subcall function 00B2E199: GetFileAttributesW.KERNEL32(?,00B2CF95), ref: 00B2E19A

FindFirstFileW.KERNEL32(?,?), ref: 00B2D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00B2D1DD
MoveFileW.KERNEL32(?,?), ref: 00B2D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00B2D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B2D237

Part of subcall function 00B2D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00B2D21C,?,?), ref: 00B2D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00B2D253
FindClose.KERNEL32(00000000), ref: 00B2D264

Strings

\*.*, xrefs: 00B2D0CD, 00B2D0D6, 00B2D0EB

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: ef683098eec93a168cd7e1ea612b29faa49fc4402f98e0f8e2aa8a0311082054
Instruction ID: cc81c48efb5a8698bb23add99e7a1fcdbdd97356600cf0d3cf504a99e9efc5c1
Opcode Fuzzy Hash: ef683098eec93a168cd7e1ea612b29faa49fc4402f98e0f8e2aa8a0311082054
Instruction Fuzzy Hash: DF615F3180125D9ECF05EBE0EA92EEDB7B5AF15301F2141A9E41677191EB319F09CB61

Function 00B3ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00B3ED91
EmptyClipboard.USER32 ref: 00B3ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00B3EDAC
CloseClipboard.USER32 ref: 00B3EEA3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: f361dcd099b9cc6fcca0e9a61d6937e42904219d15d341e7f3c60210fa8fd29b
Instruction ID: a168ca5c180fd71488af6d0b7a9158eb7c734e7583c51fb1343c0a5672e68c89
Opcode Fuzzy Hash: f361dcd099b9cc6fcca0e9a61d6937e42904219d15d341e7f3c60210fa8fd29b
Instruction Fuzzy Hash: B1417C35204611AFE710DF15D888F1ABBE5EF44329F2580DAE4299B6A2CB35ED42CB90

Function 00B2E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00B216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B2170D
Part of subcall function 00B216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B2173A
Part of subcall function 00B216C3: GetLastError.KERNEL32 ref: 00B2174A

ExitWindowsEx.USER32(?,00000000), ref: 00B2E932

Strings

, xrefs: 00B2E95C
, xrefs: 00B2E920
SeShutdownPrivilege, xrefs: 00B2E902
@, xrefs: 00B2E925

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 01400a7cd3b8a70a6e32de31897c9a86a5e7b4c3f896fb56c37b0ed1df219000
Instruction ID: 40cc0dd59906a049877cf645d9926601ae3169452ce8240e7f312cb6acaf1b1f
Opcode Fuzzy Hash: 01400a7cd3b8a70a6e32de31897c9a86a5e7b4c3f896fb56c37b0ed1df219000
Instruction Fuzzy Hash: 7C012B32610330AFEB5426BABC8ABBF72DCD718741F1508A3F82AE30D1DA709C808194

Function 00B41204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00B41276
WSAGetLastError.WSOCK32 ref: 00B41283
bind.WSOCK32(00000000,?,00000010), ref: 00B412BA
WSAGetLastError.WSOCK32 ref: 00B412C5
closesocket.WSOCK32(00000000), ref: 00B412F4
listen.WSOCK32(00000000,00000005), ref: 00B41303
WSAGetLastError.WSOCK32 ref: 00B4130D
closesocket.WSOCK32(00000000), ref: 00B4133C

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 4d37c443f9766f4698f51973e7578812123e5a2666e482ee062f47d7a6a2a3f3
Instruction ID: 922f44070eac279b838b5da7003d49a9eb7031868555a03dc8e3999c22e3ce17
Opcode Fuzzy Hash: 4d37c443f9766f4698f51973e7578812123e5a2666e482ee062f47d7a6a2a3f3
Instruction Fuzzy Hash: D2416031A00210AFD710DF68C585B29BBE6EF46318F1885D8D8569F392C771ED81DBE1

Function 00B2D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AC3A97,?,?,00AC2E7F,?,?,?,00000000), ref: 00AC3AC2

Part of subcall function 00B2E199: GetFileAttributesW.KERNEL32(?,00B2CF95), ref: 00B2E19A

FindFirstFileW.KERNEL32(?,?), ref: 00B2D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00B2D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B2D481
FindClose.KERNEL32(00000000), ref: 00B2D498
FindClose.KERNEL32(00000000), ref: 00B2D4A1

Strings

\*.*, xrefs: 00B2D3F2

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: f634c96ec28b2007d0d4eb52bd830f5973228037bf2036b47ae6f5537d2e83f1
Instruction ID: b0143c180087388463a13af223366715fb4afa2003ee689fec720a8a88060cfa
Opcode Fuzzy Hash: f634c96ec28b2007d0d4eb52bd830f5973228037bf2036b47ae6f5537d2e83f1
Instruction Fuzzy Hash: 8E31A0310083959FC701FF60D996EAFB7E8AE91304F404A5DF4E593291EB30AA09CB63

Function 00AFE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00AFE645

Strings

1#QNAN, xrefs: 00AFF84B
1#IND, xrefs: 00AFF83D
1#INF, xrefs: 00AFF852
1#SNAN, xrefs: 00AFF844

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 37ff4fe09a0d9c00b395783f39eb2908b82c7ffef0f18f924858d68004e13bdb
Instruction ID: 569ceeeb8b420a583fab3056c5d11b0b5bf48249e033902a44554cee117abc90
Opcode Fuzzy Hash: 37ff4fe09a0d9c00b395783f39eb2908b82c7ffef0f18f924858d68004e13bdb
Instruction Fuzzy Hash: 61C23871E046288FDB25CFA89D407EAB7B5EF44345F1441EAE94DE7250E778AE818F40

Function 00B3648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B364DC
CoInitialize.OLE32(00000000), ref: 00B36639
CoCreateInstance.OLE32(00B5FCF8,00000000,00000001,00B5FB68,?), ref: 00B36650
CoUninitialize.OLE32 ref: 00B368D4

Strings

.lnk, xrefs: 00B364BA, 00B36524, 00B365E0

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: e9aa94219281c29a7040c4d2e1b13eca1360254ec5b3c10b33439161ad66988a
Instruction ID: fcd96cd365e815660986970240c183454e2c0d14efc3462526ebadb1fd071ba2
Opcode Fuzzy Hash: e9aa94219281c29a7040c4d2e1b13eca1360254ec5b3c10b33439161ad66988a
Instruction Fuzzy Hash: 7AD13871508305AFC304EF24C981E6BB7E9FF98704F11896DF5958B2A1EB70E909CB92

Function 00B422DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00B422E8

Part of subcall function 00B3E4EC: GetWindowRect.USER32(?,?), ref: 00B3E504

GetDesktopWindow.USER32 ref: 00B42312
GetWindowRect.USER32(00000000), ref: 00B42319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00B42355
GetCursorPos.USER32(?), ref: 00B42381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00B423DF

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 23dee7f6468727e0783c891cbbf53546aa6df6c69b595d540841e102d1b09e32
Instruction ID: 3dbe8c126a15298e622186826c0ed06b15f1b128e4523a937eeda67f6a8f31a3
Opcode Fuzzy Hash: 23dee7f6468727e0783c891cbbf53546aa6df6c69b595d540841e102d1b09e32
Instruction Fuzzy Hash: B9310272504315AFC720DF54DC45B5BBBEAFF88314F40095AF89897181DB34EA08DB96

Function 00B39B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00B39B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00B39C8B

Part of subcall function 00B33874: GetInputState.USER32 ref: 00B338CB
Part of subcall function 00B33874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B33966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00B39BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00B39C75

Strings

*.*, xrefs: 00B39B5D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 0288e4fcecf93cc4f54889b08b0a7e6e1785209df7bffc5a356b7385f59a23f1
Instruction ID: d1a24c097c3d05707b196cee13d3f4d90b4924a9ce5dda34ddd57c3663e4680b
Opcode Fuzzy Hash: 0288e4fcecf93cc4f54889b08b0a7e6e1785209df7bffc5a356b7385f59a23f1
Instruction Fuzzy Hash: E641737190420AAFCF15DF64D989BEEBBF4EF05311F644199E805A31A1EB719E84CF60

Function 00AD997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00AD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AD9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00AD9A4E
GetSysColor.USER32(0000000F), ref: 00AD9B23
SetBkColor.GDI32(?,00000000), ref: 00AD9B36

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 10899a9dc6e79489bb416022848a15ed48c591072d5981064628efa16e43afec
Instruction ID: c5623ff0965152c57c67aa1c45c71bd846520dff911ca47eb1883c7d440313a7
Opcode Fuzzy Hash: 10899a9dc6e79489bb416022848a15ed48c591072d5981064628efa16e43afec
Instruction Fuzzy Hash: 56A1F471248504AEE725AB2C8C99EBB3AFDDB42380F15429BF403D77A1DE25DD42D272

Function 00B41806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00B4307A
Part of subcall function 00B4304E: _wcslen.LIBCMT ref: 00B4309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00B4185D
WSAGetLastError.WSOCK32 ref: 00B41884
bind.WSOCK32(00000000,?,00000010), ref: 00B418DB
WSAGetLastError.WSOCK32 ref: 00B418E6
closesocket.WSOCK32(00000000), ref: 00B41915

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: ae187d4fe42a4d2e35a4fd1a5b98eb5d50944135300170b1d6df198c8bdf22c8
Instruction ID: aa4851b6f7ad532131269c2be790efe89b3a5d573d8b9b44d0bfb22f5490e7a3
Opcode Fuzzy Hash: ae187d4fe42a4d2e35a4fd1a5b98eb5d50944135300170b1d6df198c8bdf22c8
Instruction Fuzzy Hash: 7E51B471A00210AFDB10EF24C986F6A7BE5EB44718F09849CF9066F3D3D771AD428BA1

Function 00B51C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00B51CC0
IsWindowEnabled.USER32 ref: 00B51CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00B51CDB
IsIconic.USER32 ref: 00B51CE9
IsZoomed.USER32 ref: 00B51CF7

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: c4fa5ef7297cd5d6c9da7d2df069580be5c0f00aa21ec6393cfd5da8dce68312
Instruction ID: ed6a1344715c236ace9f6dbcbd7dfdd785497da67a693fd6c441cec53c09667c
Opcode Fuzzy Hash: c4fa5ef7297cd5d6c9da7d2df069580be5c0f00aa21ec6393cfd5da8dce68312
Instruction Fuzzy Hash: 302180317412105FD7209F1AD884F6A7BE5EF99326B1984ECEC4A8B351DB72EC46CB90

Function 00AC8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00AC83E8
ERCP, xrefs: 00AC813C
VUUU, xrefs: 00AC83FA
VUUU, xrefs: 00AC843C
VUUU, xrefs: 00B05DF0

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 4f20d31501599450c270bc707d1a81cf31e7bde166709d4582353b0c235fe8dc
Instruction ID: cbcad00403295aa5df4cf95f047349b387441e58a8edcb467c99421e298e9e39
Opcode Fuzzy Hash: 4f20d31501599450c270bc707d1a81cf31e7bde166709d4582353b0c235fe8dc
Instruction Fuzzy Hash: AAA24E71E0061ACBDF24CF58C940BAEBBB1FF54310F2581AAD815AB685EB749D91CF90

Function 00B4A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00B4A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00B4A6BA

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

Process32NextW.KERNEL32(00000000,?), ref: 00B4A79C
CloseHandle.KERNEL32(00000000), ref: 00B4A7AB

Part of subcall function 00ADCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00B03303,?), ref: 00ADCE8A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 7b51bd9cefd873b36b54b1913c0c1fd3633050156f7ce4d8a6f31ac1cf421ac7
Instruction ID: 7a935e9ab42f9e363ea1b1971bea0ad4c3eb97498f6903d482b7a44a5c157feb
Opcode Fuzzy Hash: 7b51bd9cefd873b36b54b1913c0c1fd3633050156f7ce4d8a6f31ac1cf421ac7
Instruction Fuzzy Hash: 23514BB1508300AFD710EF24C986E6BBBE8FF89754F41495DF59A97251EB30E904CB92

Function 00B2AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00B2AAAC
SetKeyboardState.USER32(00000080), ref: 00B2AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00B2AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00B2AB88

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 18979b237debc90e4e826a74c6dab0c264aa5b33b509b373ff0946e38b906a4c
Instruction ID: ec0d89936ccdeb3c5487e0cfb663e21569499e46fae06a164d0e9a6f4ac47965
Opcode Fuzzy Hash: 18979b237debc90e4e826a74c6dab0c264aa5b33b509b373ff0946e38b906a4c
Instruction Fuzzy Hash: A8312830A40328AFFB319A64AC0DBFA7BE7EF44310F04429AF189521D0D7748985C763

Function 00AFBB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00AFBB7F

Part of subcall function 00AF29C8: HeapFree.KERNEL32(00000000,00000000,?,00AFD7D1,00000000,00000000,00000000,00000000,?,00AFD7F8,00000000,00000007,00000000,?,00AFDBF5,00000000), ref: 00AF29DE
Part of subcall function 00AF29C8: GetLastError.KERNEL32(00000000,?,00AFD7D1,00000000,00000000,00000000,00000000,?,00AFD7F8,00000000,00000007,00000000,?,00AFDBF5,00000000,00000000), ref: 00AF29F0

GetTimeZoneInformation.KERNEL32 ref: 00AFBB91
WideCharToMultiByte.KERNEL32(00000000,?,00B9121C,000000FF,?,0000003F,?,?), ref: 00AFBC09
WideCharToMultiByte.KERNEL32(00000000,?,00B91270,000000FF,?,0000003F,?,?,?,00B9121C,000000FF,?,0000003F,?,?), ref: 00AFBC36

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 2559a45e23e3b3a0f3cd85e5a90a8df8534d1dc36ac1823bd247c2e78ab7e80e
Instruction ID: 9a4880b399d721828cf3cfc5a8c238e6da8d44dff8d9e8f1be93a9eb5a427fe5
Opcode Fuzzy Hash: 2559a45e23e3b3a0f3cd85e5a90a8df8534d1dc36ac1823bd247c2e78ab7e80e
Instruction Fuzzy Hash: C031B27191420ADFCB11EFA9DD8097ABBB8FF4575071486AAF260DB2B1DB309D01DB60

Function 00B3CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00B3CE89
GetLastError.KERNEL32(?,00000000), ref: 00B3CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00B3CEFE

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 44a7e74053016f09fcaa53465147a893e236f45a6e43530c71d7f31316edb366
Instruction ID: b481e3c62a7d199de975c63a94fc8c130903921ee2e690890118929682cd651c
Opcode Fuzzy Hash: 44a7e74053016f09fcaa53465147a893e236f45a6e43530c71d7f31316edb366
Instruction Fuzzy Hash: 6321CF715003159FE720DFA5C988BA77BFDEB00314F20449EE546E2151EB70EE08CB60

Function 00B28298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00B282AA

Strings

|, xrefs: 00B282DA
(, xrefs: 00B282F0

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: fd52d9bfc4723cceefd91b1362db90877ad017bc6361e66c3abeca2e426bfd88
Instruction ID: 8c657d201da82812b302ee50e6c0472a512883ad9544d4674e8cf73aab61719d
Opcode Fuzzy Hash: fd52d9bfc4723cceefd91b1362db90877ad017bc6361e66c3abeca2e426bfd88
Instruction Fuzzy Hash: F7323475A01615DFCB28CF19D480A6AB7F0FF48710B15C5AEE49ADB3A1EB70E941CB44

Function 00B35C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B35CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00B35D17
FindClose.KERNEL32(?), ref: 00B35D5F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 5cf22e3ace5bc9df68bfe4ae99b0ec6e6e44338013b72a6b86181684744dd478
Instruction ID: ce97ce5c179d299874654021f32af8936be7a98d3a80b887bb46e87a818c075c
Opcode Fuzzy Hash: 5cf22e3ace5bc9df68bfe4ae99b0ec6e6e44338013b72a6b86181684744dd478
Instruction Fuzzy Hash: 57518A74604B019FC724DF28C494E9AB7E4FF49324F2485ADE95A8B3A1CB30ED45CB91

Function 00AF2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00AF271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AF2724
UnhandledExceptionFilter.KERNEL32(?), ref: 00AF2731

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 559e00029f4c1c660e001da4ff07b7100c6ddaec9ca4334c541f85a5fc13fd54
Instruction ID: 5f832b5a936760a48b0297c8e9d4e03a2b74a3d92ade6caaf9e05c37c18e8208
Opcode Fuzzy Hash: 559e00029f4c1c660e001da4ff07b7100c6ddaec9ca4334c541f85a5fc13fd54
Instruction Fuzzy Hash: 7D31B57491131C9BCB21DF69DD89B9DBBB8AF08310F5041EAE41CA7261EB709F818F45

Function 00B351CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B351DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00B35238
SetErrorMode.KERNEL32(00000000), ref: 00B352A1

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: fcbf9b59146c574900cf1860cb12cc7e4554fbfa1fb9f5a1de0864b582ef2f76
Instruction ID: 01589a0edf570846af8e606786817e478f3ab407f7f32150d15e1e02002c695b
Opcode Fuzzy Hash: fcbf9b59146c574900cf1860cb12cc7e4554fbfa1fb9f5a1de0864b582ef2f76
Instruction Fuzzy Hash: 3C314B75A006189FDB00DF54D884FAEBBF5FF48314F158099E809AB362DB31E856CB90

Function 00B216C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00ADFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00AE0668
Part of subcall function 00ADFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00AE0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B2170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B2173A
GetLastError.KERNEL32 ref: 00B2174A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: f3e54fff0dc4a801a25171a104ec210bf2b2ed8b029b068f288a07fcbb721aca
Instruction ID: 6b965b4a52cf0e8fe616cf08df809c2eb6e05839613e1cc609d1f99a1913d3a9
Opcode Fuzzy Hash: f3e54fff0dc4a801a25171a104ec210bf2b2ed8b029b068f288a07fcbb721aca
Instruction Fuzzy Hash: 3A11C1B2400304AFD7189F54ECC6E6BBBFAEB44B24B20856EE05A53251EB70BC418A24

Function 00B2D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00B2D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00B2D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00B2D650

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 7686dc9c6b9d141e3ef2eb04a78e56f42fc48b42b55c2a677205ae499092e32d
Instruction ID: 63714099990d8b5046e02449475c2fba4d1e6dc5015ad95c697711f2f9d188ab
Opcode Fuzzy Hash: 7686dc9c6b9d141e3ef2eb04a78e56f42fc48b42b55c2a677205ae499092e32d
Instruction Fuzzy Hash: 3F117C71E01328BFDB108F94AC44FAFBFBCEB49B50F108151F918E7290C6704A018BA1

Function 00B21663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00B2168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00B216A1
FreeSid.ADVAPI32(?), ref: 00B216B1

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 2def4de96164b914578c648c831f68bdc5140fc4906787f70762f461e50c8ce4
Instruction ID: a777534da362080ba9fc3b05c4c0d8a53b26eaf572930995d456be6c505050f9
Opcode Fuzzy Hash: 2def4de96164b914578c648c831f68bdc5140fc4906787f70762f461e50c8ce4
Instruction Fuzzy Hash: 6AF0F471950309FFDB00DFE49C89AAEBBBDEB08605F5449A5E501E2181E774AA448A50

Function 00AE4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00AF28E9,?,00AE4CBE,00AF28E9,00B888B8,0000000C,00AE4E15,00AF28E9,00000002,00000000,?,00AF28E9), ref: 00AE4D09
TerminateProcess.KERNEL32(00000000,?,00AE4CBE,00AF28E9,00B888B8,0000000C,00AE4E15,00AF28E9,00000002,00000000,?,00AF28E9), ref: 00AE4D10
ExitProcess.KERNEL32 ref: 00AE4D22

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 25ad6d88088987c2efc73bb961bdc25a1529162dbbbf7cec9ea6e021475d0e11
Instruction ID: 6c2acb04f8fc68d252c991fa3dfac8c525890b25251dd3e9aaab83780a6d5cf8
Opcode Fuzzy Hash: 25ad6d88088987c2efc73bb961bdc25a1529162dbbbf7cec9ea6e021475d0e11
Instruction Fuzzy Hash: 5FE09231000688AFCF11AF55DE49A593F6AEB89782B104094F9059B222CB35D942CA84

Function 00B1D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00B1D28C

Strings

X64, xrefs: 00B1D2A8

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 5eccc12c5cc04def8ab486f41ce1431e1e0bcc474a7b8e983587aa7ce501c055
Instruction ID: 88742e362f3b1360c35751e73d530303a0f230b6127c2b1424b003169f9b5f81
Opcode Fuzzy Hash: 5eccc12c5cc04def8ab486f41ce1431e1e0bcc474a7b8e983587aa7ce501c055
Instruction Fuzzy Hash: FFD0C9B480121DEECF90CB90DCC8DD9B7BCBB04305F100192F106A2140DB7496488F10

Function 00AECAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: b82d6febe24f4c819fe493cbc678a451d6de96f2b13f056cb2225cae406b6946
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: B5021E71E002599FDF14CFA9C9906ADFBF1EF88324F258169D919E7380D731AA428B94

Function 00B368EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B36918
FindClose.KERNEL32(00000000), ref: 00B36961

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f588d0e429a154777bbc858a7c732e370f83c2aff2494372d8c52781d484f2e8
Instruction ID: 3807474cd2673db8e1e53472680c2f1b128f25729a621ee54fa2b3359ef2adf0
Opcode Fuzzy Hash: f588d0e429a154777bbc858a7c732e370f83c2aff2494372d8c52781d484f2e8
Instruction Fuzzy Hash: 8F118E31604200AFC710DF29D488B16BBE5EF89329F15C69DE4699F6A2CB30EC05CB91

Function 00B337B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00B44891,?,?,00000035,?), ref: 00B337E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00B44891,?,?,00000035,?), ref: 00B337F4

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: fe14b029e9e3a260eb625bf9aeaa6e63bcb902d2b68faf09053aa494457c9811
Instruction ID: fe2913d17cef3474eb9a3c7dae5a6092d4a72eb4ace60d5d30f232f5a8d83b57
Opcode Fuzzy Hash: fe14b029e9e3a260eb625bf9aeaa6e63bcb902d2b68faf09053aa494457c9811
Instruction Fuzzy Hash: 26F0E5B06043296EE720176A8C4DFEB3AEEEFC4B61F0001A5F509D3291D9609D04C7B1

Function 00B210BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B211FC), ref: 00B210D4
CloseHandle.KERNEL32(?,?,00B211FC), ref: 00B210E9

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 72d3c285e4e0b381edfb3556812f1b1a3bf8e19658aaec432991b2088071b6a3
Instruction ID: 9f51b1be0bf01092b1efd28b29596f265351e848a0d01e41b2b59bcac2d16d14
Opcode Fuzzy Hash: 72d3c285e4e0b381edfb3556812f1b1a3bf8e19658aaec432991b2088071b6a3
Instruction Fuzzy Hash: BDE04F32004710AEEB252B51FC05F737BEAEB04311B14886EF4A7814B1DF626C90DB54

Function 00ACCAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00B10C40

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: f613f686e4bbfcd461fbcf894a0b91db48a7bd295330ff4833f12d9f9eaae418
Instruction ID: 80c4bc2ec56112b43819d96896ad77aa81f5938808473bd8dd54a1dc4f2cec05
Opcode Fuzzy Hash: f613f686e4bbfcd461fbcf894a0b91db48a7bd295330ff4833f12d9f9eaae418
Instruction Fuzzy Hash: CD327A749142189BCF14EF90C981FEDB7B5FF05314F5140ADE80AAB292DB75AE86CB60

Function 00AF676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00AF6766,?,?,00000008,?,?,00AFFEFE,00000000), ref: 00AF6998

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 9228f65e7f577396f949c64a901b246707f40e583b8bcb7188715af57f2bceb0
Instruction ID: 7da4230c4e138572987d8ff795bd500de25492a1131973a816877ce9365ea3a9
Opcode Fuzzy Hash: 9228f65e7f577396f949c64a901b246707f40e583b8bcb7188715af57f2bceb0
Instruction Fuzzy Hash: 84B129316106099FD715CF68C48AB657BB0FF45364F29865CFA9ACF2A2C335E991CB40

Function 00ADB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00B1851F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 1c29313a46f617c3ed82029a3d720d0d3fa4b70f0f2b35a6107c0ef596e2d8ba
Instruction ID: 6daf69dc80ea7c1f93fde1e69dd49925f8cf5c02e226132371e8f0c0588b31ef
Opcode Fuzzy Hash: 1c29313a46f617c3ed82029a3d720d0d3fa4b70f0f2b35a6107c0ef596e2d8ba
Instruction Fuzzy Hash: D8124EB5910229DBCB14CF58C881AEEB7F5FF48710F55819AE849EB351DB309A81CBA4

Function 00B3EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00B3EABD

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: bbb28f04c84eff6541bc17e79fdb14e53b2b8535db82d2910fe4b77e11d58aed
Instruction ID: 46103673f3807c1735c2d7c219fd4a44cc3c89df54597feaf41f9bbc5ca54afa
Opcode Fuzzy Hash: bbb28f04c84eff6541bc17e79fdb14e53b2b8535db82d2910fe4b77e11d58aed
Instruction Fuzzy Hash: C9E01A352102059FC710EF59D845E9ABBE9AF98760F11845AFC4AD7391DB70E8418BA0

Function 00AE09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00AE03EE), ref: 00AE09DA

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a1efe10b9c3a418883f758003342d85688333b848c8c67480a0923cb04de554f
Instruction ID: 99d870b346f1142a8fb5df95ab50b7575a3a0ab05e8000de8c816dc9952bf48c
Opcode Fuzzy Hash: a1efe10b9c3a418883f758003342d85688333b848c8c67480a0923cb04de554f
Instruction Fuzzy Hash:

Function 00AE781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00AE798B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: cd5da4f67e13703a4b133b7cdccaa81d74698c6689648163484dec8da9fac33b
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: E351997160C7C55BDF38877B895EBBE27E99F22340F180919D886C7283CA15DE81D352

Function 00AF6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a81aec9a8b1175809880ca476861f2562578fc48ab7a6a669fc9cb3dc9a2dfc
Instruction ID: f4c446a24881092943dbf6a7bbf01e3b1773b807299779004278ce8373072176
Opcode Fuzzy Hash: 9a81aec9a8b1175809880ca476861f2562578fc48ab7a6a669fc9cb3dc9a2dfc
Instruction Fuzzy Hash: FD322322D29F054DE7239634CC22339A649AFB73C5F15D737F81AB6AA9EF69C4834100

Function 00ADCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137432c609e65d6d13b6a31e292ecce1ef89b8a39474fd61c1fa4276df0980cf
Instruction ID: 335d901a8d6eac562ff26f8a68783668dfa71b402b898456acb1f295f8fa87b7
Opcode Fuzzy Hash: 137432c609e65d6d13b6a31e292ecce1ef89b8a39474fd61c1fa4276df0980cf
Instruction Fuzzy Hash: 8432F032A9411A8BCF28CB28C5D06FD7FE1EF45310FA885ABD94A9B295D630DDC1DB41

Function 00AC7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a1d0b69b7af263e36d9b544bf1ccc6c3b6f9034108575e053ced9ebfc78f69
Instruction ID: 1fb662ab085734d4c6cd428a424ecc3a5dc03275df84d85192e5d82becc008ac
Opcode Fuzzy Hash: 69a1d0b69b7af263e36d9b544bf1ccc6c3b6f9034108575e053ced9ebfc78f69
Instruction Fuzzy Hash: 7122ADB0A0460A9FDF14CFA4C981BAEB7F5FF48300F214569E816A7691EB36AD50CF54

Function 00AC91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f141ebba5e4737bb6bbeea7a89eaf1f159c2cf5f84253fc9d5edbd6c1dd1b8
Instruction ID: 63db4b565c81bbc3983f0de9c013dd947f317c4d196203659a49b8d82e7752bb
Opcode Fuzzy Hash: b4f141ebba5e4737bb6bbeea7a89eaf1f159c2cf5f84253fc9d5edbd6c1dd1b8
Instruction Fuzzy Hash: 5D02A4B1A00209EFDB04DF54D981AAEBBF1FF44700F1185A9E8569B391EB31EA10CB95

Function 00AF9EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e3a044517746f77b174037e686a9caa51936795f761c28b35eca172bccdec5
Instruction ID: e5651c38397bd81f705e1e0c7863a2cafa4ed6d682b6487644f486996db90a6f
Opcode Fuzzy Hash: 22e3a044517746f77b174037e686a9caa51936795f761c28b35eca172bccdec5
Instruction Fuzzy Hash: AAB10320D2AF404DD32396398871336B69CAFBB6D5F91D71BFC1A75EA2EF2685834140

Function 00AE1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 95b0b87025dcd77aeb620adc5c82cd1341917e49332fba2c3ec54fb1dbf44e36
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: FB9132726090F34ADB29473B857447EFFE19A923A131A079EE4F2CA1C5FE349964D620

Function 00AE1F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: a71d5453757f2bbce74408e17601037e1bd8b665706d0fdc58d21ee5a845bf5a
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 1E9144722090E34ADB69473F857453EFFF55A923A131A079EE4F2CB1C5EE248A54E720

Function 00AE19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: ecbdbc6295fb3d586a58a401a4f81f9da1699b73eaa73fa3f5f5eb3c8240db80
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 50911D722090F34ADB69477B857443EFEF15A923A231A07AED4F2CB1C5FE3495A4D620

Function 00AE7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 916f883098b4df4b4abb3114f3be8eb1e437a1db8074ee6390caf3f17bbd5738
Instruction ID: 81ea053d82a3596acdeab94d029d5be742df9c7a1ce2d7d7e80a52703e21a09e
Opcode Fuzzy Hash: 916f883098b4df4b4abb3114f3be8eb1e437a1db8074ee6390caf3f17bbd5738
Instruction Fuzzy Hash: 6F6159716087C996DE349B2F8DA5BBF33A8DF41780F24092EE847DB2C1DA159E42C356

Function 00AE7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1746d9ce1ba932fa7c58e40933988e6c82c5695bf02148c3ab2a0540514da522
Instruction ID: 45ab19d56b9f5f5b9d37838c8ea21f0f3bb96d8c026ad12a670d89a46aef8338
Opcode Fuzzy Hash: 1746d9ce1ba932fa7c58e40933988e6c82c5695bf02148c3ab2a0540514da522
Instruction Fuzzy Hash: 7961BB7120C7C967DE388B2B4DE1BBF2399EF42740F10095AE943CF281EA16ED428B55

Function 00AE1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 285d12a1b529f771d9330aa87c6d26b52f760049a2b3ab4988a65be6c5629b1d
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: C48162726090F34ADB6D473B857447EFFE15A923A131A079ED4F2CA1C2EE349554E620

Function 00B32046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72da5fb06f18b04d202e5c40e4f47fc543d191ac26e64cbff547d1d865002a45
Instruction ID: 211cbca6965a4bc152984ecc0b357c470e5f2acbaa9c81a2a22d0411dac1366e
Opcode Fuzzy Hash: 72da5fb06f18b04d202e5c40e4f47fc543d191ac26e64cbff547d1d865002a45
Instruction Fuzzy Hash: A121A5326216118BDB2CCF79C92267E73E5E754310F25866EE4A7C77D0DE35A904CB80

Function 00B42ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B42B30
DeleteObject.GDI32(00000000), ref: 00B42B43
DestroyWindow.USER32 ref: 00B42B52
GetDesktopWindow.USER32 ref: 00B42B6D
GetWindowRect.USER32(00000000), ref: 00B42B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00B42CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00B42CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B42CF8
GetClientRect.USER32(00000000,?), ref: 00B42D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00B42D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B42D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B42D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B42D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B42D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B42D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B42DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B42DA8
GlobalFree.KERNEL32(00000000), ref: 00B42DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B42DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00B5FC38,00000000), ref: 00B42DDB
GlobalFree.KERNEL32(00000000), ref: 00B42DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00B42E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00B42E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B42E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B4303F

Strings

AutoIt v3, xrefs: 00B42CF2
static, xrefs: 00B42D3A, 00B42E91
DISPLAY, xrefs: 00B42EA2
, xrefs: 00B42FC5

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 5678af40f0c72bd9485a3c4b8215e64ca5658b4a80691a6638b1f03cc6bcae28
Instruction ID: c9dc8219a187814526329d9b9f17f2da1b3143c10e9d1ae1e33e6283ef85522f
Opcode Fuzzy Hash: 5678af40f0c72bd9485a3c4b8215e64ca5658b4a80691a6638b1f03cc6bcae28
Instruction Fuzzy Hash: 50027D75500209AFDB14DF64CD89FAE7BBAEB48711F048598F915AB2A1CB70AE01DF60

Function 00B570D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00B5712F
GetSysColorBrush.USER32(0000000F), ref: 00B57160
GetSysColor.USER32(0000000F), ref: 00B5716C
SetBkColor.GDI32(?,000000FF), ref: 00B57186
SelectObject.GDI32(?,?), ref: 00B57195
InflateRect.USER32(?,000000FF,000000FF), ref: 00B571C0
GetSysColor.USER32(00000010), ref: 00B571C8
CreateSolidBrush.GDI32(00000000), ref: 00B571CF
FrameRect.USER32(?,?,00000000), ref: 00B571DE
DeleteObject.GDI32(00000000), ref: 00B571E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00B57230
FillRect.USER32(?,?,?), ref: 00B57262
GetWindowLongW.USER32(?,000000F0), ref: 00B57284

Part of subcall function 00B573E8: GetSysColor.USER32(00000012), ref: 00B57421
Part of subcall function 00B573E8: SetTextColor.GDI32(?,?), ref: 00B57425
Part of subcall function 00B573E8: GetSysColorBrush.USER32(0000000F), ref: 00B5743B
Part of subcall function 00B573E8: GetSysColor.USER32(0000000F), ref: 00B57446
Part of subcall function 00B573E8: GetSysColor.USER32(00000011), ref: 00B57463
Part of subcall function 00B573E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B57471
Part of subcall function 00B573E8: SelectObject.GDI32(?,00000000), ref: 00B57482
Part of subcall function 00B573E8: SetBkColor.GDI32(?,00000000), ref: 00B5748B
Part of subcall function 00B573E8: SelectObject.GDI32(?,?), ref: 00B57498
Part of subcall function 00B573E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00B574B7
Part of subcall function 00B573E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B574CE
Part of subcall function 00B573E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00B574DB

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: d670494efecb04b656513c6a11529afad3961c01f76ee84d7100bee1b37f1112
Instruction ID: c6bbcb47fe59d0906dc5f79e929dcbd8af4f625592450861757411994e701557
Opcode Fuzzy Hash: d670494efecb04b656513c6a11529afad3961c01f76ee84d7100bee1b37f1112
Instruction Fuzzy Hash: 5DA19172108701AFDB019F60EC49F5B7BEAFB49322F100A99F962A71E1DB71E944CB51

Function 00AD8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00AD8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00B16AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00B16AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00B16F43

Part of subcall function 00AD8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AD8BE8,?,00000000,?,?,?,?,00AD8BBA,00000000,?), ref: 00AD8FC5

SendMessageW.USER32(?,00001053), ref: 00B16F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00B16F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00B16FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00B16FB7

Strings

0, xrefs: 00B16DCF

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: b9722e42a0c5d71c755c7446bbfdeeb2fa50a9f08874b91c3699fafc59b7ce51
Instruction ID: abcfe8e033a683fbada1af08eff08910eed08875dc2e9ea5412b02cf18baa2e1
Opcode Fuzzy Hash: b9722e42a0c5d71c755c7446bbfdeeb2fa50a9f08874b91c3699fafc59b7ce51
Instruction Fuzzy Hash: 15129C31204201DFDB25CF28D985BA6BBF5FB44301F9449AAE496CB261CB35EC92DF91

Function 00B42711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00B4273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B4286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00B428A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00B428B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00B42900
GetClientRect.USER32(00000000,?), ref: 00B4290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00B42955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00B42964
GetStockObject.GDI32(00000011), ref: 00B42974
SelectObject.GDI32(00000000,00000000), ref: 00B42978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00B42988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B42991
DeleteDC.GDI32(00000000), ref: 00B4299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00B429C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00B429DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00B42A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00B42A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00B42A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00B42A77
GetStockObject.GDI32(00000011), ref: 00B42A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00B42A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00B42A97

Strings

AutoIt v3, xrefs: 00B428F8
static, xrefs: 00B4294F, 00B42A71
DISPLAY, xrefs: 00B4295A
msctls_progress32, xrefs: 00B42A13

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: ec03ca1aee5cb9b09d2a0c345b2dfdb2d8b32194bf736af28afc120f7ca288ea
Instruction ID: 0df92dd86cd89ea1958cfa186877e81fbb2877636c0f13f7be18ea9228b6074c
Opcode Fuzzy Hash: ec03ca1aee5cb9b09d2a0c345b2dfdb2d8b32194bf736af28afc120f7ca288ea
Instruction Fuzzy Hash: 65B13D71A00219BFEB14DF68CD86FAE7BB9EB08711F004559F915E72A0DB70AD40DB64

Function 00B34ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B34AED
GetDriveTypeW.KERNEL32(?,00B5CB68,?,\\.\,00B5CC08), ref: 00B34BCA
SetErrorMode.KERNEL32(00000000,00B5CB68,?,\\.\,00B5CC08), ref: 00B34D36

Strings

RAID, xrefs: 00B34CBB
SSA, xrefs: 00B34CA6
ATA, xrefs: 00B34C98
USB, xrefs: 00B34CB4
CDROM, xrefs: 00B34BFB
Fixed, xrefs: 00B34C09
MMC, xrefs: 00B34CDE
SAS, xrefs: 00B34CC9
Unknown, xrefs: 00B34BED, 00B34C83
1394, xrefs: 00B34C9F
SSD, xrefs: 00B34C4A
FileBackedVirtual, xrefs: 00B34CEC
SATA, xrefs: 00B34CD0
Fibre, xrefs: 00B34CAD
Removable, xrefs: 00B34C10, 00B34C15
Network, xrefs: 00B34C02
Virtual, xrefs: 00B34CE5
SCSI, xrefs: 00B34C8A
\\.\, xrefs: 00B34B3F
ATAPI, xrefs: 00B34C91
RAMDisk, xrefs: 00B34BF4
PhysicalDrive, xrefs: 00B34B76
iSCSI, xrefs: 00B34CC2

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 6dd856a15d0c9186373438ed1705a8050244ebae551d17534259a09d5472761e
Instruction ID: e92f3558d771ba6605c3573cf50e8907015fa98139caa19cab419988b0146805
Opcode Fuzzy Hash: 6dd856a15d0c9186373438ed1705a8050244ebae551d17534259a09d5472761e
Instruction Fuzzy Hash: 60617E30605206ABCB04EF24CAC2E69B7E1EB05740F7494E9F806AB6A2DB75FD41DB41

Function 00B573E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00B57421
SetTextColor.GDI32(?,?), ref: 00B57425
GetSysColorBrush.USER32(0000000F), ref: 00B5743B
GetSysColor.USER32(0000000F), ref: 00B57446
CreateSolidBrush.GDI32(?), ref: 00B5744B
GetSysColor.USER32(00000011), ref: 00B57463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B57471
SelectObject.GDI32(?,00000000), ref: 00B57482
SetBkColor.GDI32(?,00000000), ref: 00B5748B
SelectObject.GDI32(?,?), ref: 00B57498
InflateRect.USER32(?,000000FF,000000FF), ref: 00B574B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B574CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00B574DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B5752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00B57554
InflateRect.USER32(?,000000FD,000000FD), ref: 00B57572
DrawFocusRect.USER32(?,?), ref: 00B5757D
GetSysColor.USER32(00000011), ref: 00B5758E
SetTextColor.GDI32(?,00000000), ref: 00B57596
DrawTextW.USER32(?,00B570F5,000000FF,?,00000000), ref: 00B575A8
SelectObject.GDI32(?,?), ref: 00B575BF
DeleteObject.GDI32(?), ref: 00B575CA
SelectObject.GDI32(?,?), ref: 00B575D0
DeleteObject.GDI32(?), ref: 00B575D5
SetTextColor.GDI32(?,?), ref: 00B575DB
SetBkColor.GDI32(?,?), ref: 00B575E5

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 272cf7e2d9532d02e46c9f5415705ccf9d3b368afa3c408ceb343672fd22adf9
Instruction ID: 664973cda231c727d9adafbcf31e30bc174e9c0f437d68382e9b8adc16ff7afe
Opcode Fuzzy Hash: 272cf7e2d9532d02e46c9f5415705ccf9d3b368afa3c408ceb343672fd22adf9
Instruction Fuzzy Hash: 8E613E72904318AFDF019FA4EC49BAE7FB9EB08321F114195F915BB2A1DB759940CB90

Function 00B50FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00B51128
GetDesktopWindow.USER32 ref: 00B5113D
GetWindowRect.USER32(00000000), ref: 00B51144
GetWindowLongW.USER32(?,000000F0), ref: 00B51199
DestroyWindow.USER32(?), ref: 00B511B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00B511ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B5120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B5121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00B51232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00B51245
IsWindowVisible.USER32(00000000), ref: 00B512A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00B512BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00B512D0
GetWindowRect.USER32(00000000,?), ref: 00B512E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00B5130E
GetMonitorInfoW.USER32(00000000,?), ref: 00B51328
CopyRect.USER32(?,?), ref: 00B5133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00B513AA

Strings

tooltips_class32, xrefs: 00B511E6
0, xrefs: 00B510D3
(, xrefs: 00B5131B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: d224a5993eee5c751f2b9dbb780e13c639dd0cf7db227c80debf68ce45d2d38a
Instruction ID: 0096d6e31102aaa48c09186346d3dda2af4f60fe26575d13feb7bdba6302cd8e
Opcode Fuzzy Hash: d224a5993eee5c751f2b9dbb780e13c639dd0cf7db227c80debf68ce45d2d38a
Instruction Fuzzy Hash: 59B18B71604341AFD700DF68C985B6ABBE5FF84351F00899CF9999B2A1CB71EC49CBA1

Function 00AD8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AD8968
GetSystemMetrics.USER32(00000007), ref: 00AD8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AD899B
GetSystemMetrics.USER32(00000008), ref: 00AD89A3
GetSystemMetrics.USER32(00000004), ref: 00AD89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00AD89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00AD89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00AD8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00AD8A3C
GetClientRect.USER32(00000000,000000FF), ref: 00AD8A5A
GetStockObject.GDI32(00000011), ref: 00AD8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00AD8A81

Part of subcall function 00AD912D: GetCursorPos.USER32(?), ref: 00AD9141
Part of subcall function 00AD912D: ScreenToClient.USER32(00000000,?), ref: 00AD915E
Part of subcall function 00AD912D: GetAsyncKeyState.USER32(00000001), ref: 00AD9183
Part of subcall function 00AD912D: GetAsyncKeyState.USER32(00000002), ref: 00AD919D

SetTimer.USER32(00000000,00000000,00000028,00AD90FC), ref: 00AD8AA8

Strings

AutoIt v3 GUI, xrefs: 00AD8A20

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 109e6d2f049e3a6af1c83602a9112779542605dc40ccd19f6f6798d85f0ef5fa
Instruction ID: bb23301d2580a19aa11c8c72105bc94edfb040e54b35cbae21afd1e5d5070f18
Opcode Fuzzy Hash: 109e6d2f049e3a6af1c83602a9112779542605dc40ccd19f6f6798d85f0ef5fa
Instruction Fuzzy Hash: 25B17A71A0020A9FDB14DFA8DD85BEE3BB5FB48715F10426AFA16A7290DB34A941CB50

Function 00B20D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B21114
Part of subcall function 00B210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00B20B9B,?,?,?), ref: 00B21120
Part of subcall function 00B210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B20B9B,?,?,?), ref: 00B2112F
Part of subcall function 00B210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B20B9B,?,?,?), ref: 00B21136
Part of subcall function 00B210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B2114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B20DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B20E29
GetLengthSid.ADVAPI32(?), ref: 00B20E40
GetAce.ADVAPI32(?,00000000,?), ref: 00B20E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B20E96
GetLengthSid.ADVAPI32(?), ref: 00B20EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00B20EB5
HeapAlloc.KERNEL32(00000000), ref: 00B20EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B20EDD
CopySid.ADVAPI32(00000000), ref: 00B20EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B20F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B20F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B20F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B20F6E
HeapFree.KERNEL32(00000000), ref: 00B20F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B20F7E
HeapFree.KERNEL32(00000000), ref: 00B20F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B20F8E
HeapFree.KERNEL32(00000000), ref: 00B20F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00B20FA1
HeapFree.KERNEL32(00000000), ref: 00B20FA8

Part of subcall function 00B21193: GetProcessHeap.KERNEL32(00000008,00B20BB1,?,00000000,?,00B20BB1,?), ref: 00B211A1
Part of subcall function 00B21193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00B20BB1,?), ref: 00B211A8
Part of subcall function 00B21193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00B20BB1,?), ref: 00B211B7

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 4f2c502c8b19748f3f02b37e8b5dd5de060d0f45e9da5403418d88b18a55805c
Instruction ID: 941b1087479147122d9e8a1edfa9882ee1676cb52bceb89416cb4b7bda98cc60
Opcode Fuzzy Hash: 4f2c502c8b19748f3f02b37e8b5dd5de060d0f45e9da5403418d88b18a55805c
Instruction Fuzzy Hash: CA716B7291031AEFDF20AFA4ED44BAEBBB9FF04311F144195F919A7192DB709905CB60

Function 00B4C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B4C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00B5CC08,00000000,?,00000000,?,?), ref: 00B4C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00B4C5A4
_wcslen.LIBCMT ref: 00B4C5F4
_wcslen.LIBCMT ref: 00B4C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00B4C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00B4C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00B4C84D
RegCloseKey.ADVAPI32(?), ref: 00B4C881
RegCloseKey.ADVAPI32(00000000), ref: 00B4C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00B4C960

Strings

REG_BINARY, xrefs: 00B4C913
REG_SZ, xrefs: 00B4C644
REG_MULTI_SZ, xrefs: 00B4C6F5
REG_DWORD, xrefs: 00B4C804
REG_EXPAND_SZ, xrefs: 00B4C5CD
REG_QWORD, xrefs: 00B4C8C3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: a2a98f1e4eb05445bd2572eed98af81b35d3dfd71dc61d202e47fc8c0391471c
Instruction ID: 0c0322f6a6f0ae5c72b41e7d72acb0fe4afa19b93a0e0102ea5bf739f880e4d6
Opcode Fuzzy Hash: a2a98f1e4eb05445bd2572eed98af81b35d3dfd71dc61d202e47fc8c0391471c
Instruction Fuzzy Hash: B31258356042019FDB54DF14C981F2ABBE5EF88724F15889CF88A9B3A2DB31ED41DB85

Function 00B5091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B509C6
_wcslen.LIBCMT ref: 00B50A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B50A54
_wcslen.LIBCMT ref: 00B50A8A
_wcslen.LIBCMT ref: 00B50B06
_wcslen.LIBCMT ref: 00B50B81

Part of subcall function 00ADF9F2: _wcslen.LIBCMT ref: 00ADF9FD

Part of subcall function 00B22BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B22BFA

Strings

GETTOTALCOUNT, xrefs: 00B509F2, 00B50A17
CHECK, xrefs: 00B50A85, 00B50AA0
GETSELECTED, xrefs: 00B50C4E
COLLAPSE, xrefs: 00B50B01, 00B50B1C
UNCHECK, xrefs: 00B50D3E
GETITEMCOUNT, xrefs: 00B50C1E
SELECT, xrefs: 00B50D11
EXPAND, xrefs: 00B50BF8
ISCHECKED, xrefs: 00B50CE1
EXISTS, xrefs: 00B50B7C, 00B50B97
GETTEXT, xrefs: 00B50C97

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 319f6f0104a56f9ab23e66634347fd43075ea71baf05e19ce6edda7c1e38d9f8
Instruction ID: dd429f1841212751914d4e8a66388801780e086fa5e4e11ef7699949945e132e
Opcode Fuzzy Hash: 319f6f0104a56f9ab23e66634347fd43075ea71baf05e19ce6edda7c1e38d9f8
Instruction Fuzzy Hash: 5EE16A352183019FC714EF24C590A2AB7E2FF98315B1549DDF89A9B3A2DB31ED49CB81

Function 00B4C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B4B6AE,?,?), ref: 00B4C9B5
_wcslen.LIBCMT ref: 00B4C9F1
_wcslen.LIBCMT ref: 00B4CA68
_wcslen.LIBCMT ref: 00B4CA9E
_wcslen.LIBCMT ref: 00B4CAF9
_wcslen.LIBCMT ref: 00B4CB2F
_wcslen.LIBCMT ref: 00B4CB7F

Strings

HKEY_CURRENT_USER, xrefs: 00B4CBBD
HKEY_LOCAL_MACHINE, xrefs: 00B4CA62, 00B4CA67
HKCU, xrefs: 00B4CBCE
HKU, xrefs: 00B4CBF0
HKLM, xrefs: 00B4CA98, 00B4CA9D
HKCR, xrefs: 00B4CB29, 00B4CB2E
HKEY_USERS, xrefs: 00B4CBDF
HKEY_CLASSES_ROOT, xrefs: 00B4CAF3, 00B4CAF8
HKEY_CURRENT_CONFIG, xrefs: 00B4CB79, 00B4CB7E
HKCC, xrefs: 00B4CBAC

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: dee700d89d81e9618aaa28d0a5c371475280c914bcabd05c4c5c2cb70c9e3704
Instruction ID: 539a9d0290022d0bf329da6e4e08dcff2f9219127d96fb8ecbfb45a7a89724cf
Opcode Fuzzy Hash: dee700d89d81e9618aaa28d0a5c371475280c914bcabd05c4c5c2cb70c9e3704
Instruction Fuzzy Hash: 4C71263360112A8BCB50DE7CCD815BB3BD1EF60B54F2105A8F866A7295EA31CF44E7A0

Function 00B5833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B5835A
_wcslen.LIBCMT ref: 00B5836E
_wcslen.LIBCMT ref: 00B58391
_wcslen.LIBCMT ref: 00B583B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00B583F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00B5361A,?), ref: 00B5844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B58487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00B584CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B58501
FreeLibrary.KERNEL32(?), ref: 00B5850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00B5851D
DestroyIcon.USER32(?), ref: 00B5852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00B58549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00B58555

Strings

.exe, xrefs: 00B58388
.icl, xrefs: 00B58368
.dll, xrefs: 00B583AB

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 5c030dbfcaa837e539e769b48ebdb988524202514445939a9f12ca61c1c5ead3
Instruction ID: b38bfb563c8766bba5ef5db2dd8c29cf01f66071693e53b84fb4518462b02fba
Opcode Fuzzy Hash: 5c030dbfcaa837e539e769b48ebdb988524202514445939a9f12ca61c1c5ead3
Instruction Fuzzy Hash: 5861BE71540309BEEB149F64DC82BBE7BACEB18722F104589FC15E61D1EF74A984CBA0

Function 00AC7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#include-once, xrefs: 00AC782F
#comments-end, xrefs: 00AC78D9
#ce, xrefs: 00AC78ED
#OnAutoItStartRegister, xrefs: 00AC7817
', xrefs: 00B05169
#comments-start, xrefs: 00AC785F, 00AC78B1
#include, xrefs: 00AC7847
Unterminated group of comments, xrefs: 00B0528C
#requireadmin, xrefs: 00AC77FF
#cs, xrefs: 00AC7873, 00AC78C5
#pragma compile, xrefs: 00AC77D3
Bad directive syntax error, xrefs: 00B0519A
#notrayicon, xrefs: 00AC77E7
Cannot parse #include, xrefs: 00B05279
", xrefs: 00B05153

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: c7b2874fa954eb492ff8154a218aa4ddec0016628005ec1994c751aacf5a3071
Instruction ID: 34fcb2f025f74e0306594e894bdbbf68941fcec979ed860155692d722d6ed1d0
Opcode Fuzzy Hash: c7b2874fa954eb492ff8154a218aa4ddec0016628005ec1994c751aacf5a3071
Instruction Fuzzy Hash: FA81F771604209BBDB20AF60CE52FAF3BE9EF15300F0540A9F909BA192EB70D915CB91

Function 00B33E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00B33EF8
_wcslen.LIBCMT ref: 00B33F03
_wcslen.LIBCMT ref: 00B33F5A
_wcslen.LIBCMT ref: 00B33F98
GetDriveTypeW.KERNEL32(?), ref: 00B33FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B3401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B34059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B34087

Strings

close cd wait, xrefs: 00B34072
close, xrefs: 00B33EFE, 00B33F18
type cdaudio alias cd wait, xrefs: 00B34001
set cd door , xrefs: 00B34028
open, xrefs: 00B33F54, 00B33F59
closed, xrefs: 00B33F08, 00B33F2D, 00B33F46, 00B33F7E, 00B33F97
open , xrefs: 00B33FE5
wait, xrefs: 00B34044

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: fa765eb47b2db231ca1864143240e475e6cbdb6eb948fed602582219d5b42c7f
Instruction ID: 5f2773140215fee5530c4fa838dcb86d3e74d0f2aec87979ca85f67c2c945fe7
Opcode Fuzzy Hash: fa765eb47b2db231ca1864143240e475e6cbdb6eb948fed602582219d5b42c7f
Instruction Fuzzy Hash: 1271E2326043019FC710EF24C981A6BB7F4EF94B58F6049ADF89697261EB30ED49CB91

Function 00B25A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00B25A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00B25A40
SetWindowTextW.USER32(?,?), ref: 00B25A57
GetDlgItem.USER32(?,000003EA), ref: 00B25A6C
SetWindowTextW.USER32(00000000,?), ref: 00B25A72
GetDlgItem.USER32(?,000003E9), ref: 00B25A82
SetWindowTextW.USER32(00000000,?), ref: 00B25A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00B25AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00B25AC3
GetWindowRect.USER32(?,?), ref: 00B25ACC
_wcslen.LIBCMT ref: 00B25B33
SetWindowTextW.USER32(?,?), ref: 00B25B6F
GetDesktopWindow.USER32 ref: 00B25B75
GetWindowRect.USER32(00000000), ref: 00B25B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00B25BD3
GetClientRect.USER32(?,?), ref: 00B25BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00B25C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00B25C2F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 3917ef2b006365728121dbbb02ade3810ff45e8e2db10a4be90c4f21a33ee40e
Instruction ID: 3ba80f30d2199f9f168618220d135c305451181e19dc4313ca413534c0abfd2a
Opcode Fuzzy Hash: 3917ef2b006365728121dbbb02ade3810ff45e8e2db10a4be90c4f21a33ee40e
Instruction Fuzzy Hash: CF718C31900B19AFDB20DFA8DE89BAEBBF5FF48705F104958E146A35A0DB74A944CB50

Function 00B3FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00B3FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00B3FE32
LoadCursorW.USER32(00000000,00007F00), ref: 00B3FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00B3FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00B3FE53
LoadCursorW.USER32(00000000,00007F01), ref: 00B3FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00B3FE69
LoadCursorW.USER32(00000000,00007F88), ref: 00B3FE74
LoadCursorW.USER32(00000000,00007F80), ref: 00B3FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00B3FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00B3FE95
LoadCursorW.USER32(00000000,00007F85), ref: 00B3FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00B3FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00B3FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00B3FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00B3FECC
GetCursorInfo.USER32(?), ref: 00B3FEDC
GetLastError.KERNEL32 ref: 00B3FF1E

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: d467692b56941cc48aa800a8da1514ae5066ae9c2af8a6366ad4863f7340620f
Instruction ID: 3ba7557ebef76053c01e2759959ed50d278289b21b34f96861bdb1b9ab766b79
Opcode Fuzzy Hash: d467692b56941cc48aa800a8da1514ae5066ae9c2af8a6366ad4863f7340620f
Instruction Fuzzy Hash: EF4163B0D0531A6ADB109FBA8C85C6EBFE8FF04754B50456AE51DE7281DB78D901CE90

Function 00AE00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00AE00C6

Part of subcall function 00AE00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00B9070C,00000FA0,EC52A78D,?,?,?,?,00B023B3,000000FF), ref: 00AE011C
Part of subcall function 00AE00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00B023B3,000000FF), ref: 00AE0127
Part of subcall function 00AE00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00B023B3,000000FF), ref: 00AE0138
Part of subcall function 00AE00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00AE014E
Part of subcall function 00AE00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00AE015C
Part of subcall function 00AE00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00AE016A
Part of subcall function 00AE00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00AE0195
Part of subcall function 00AE00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00AE01A0

___scrt_fastfail.LIBCMT ref: 00AE00E7

Part of subcall function 00AE00A3: __onexit.LIBCMT ref: 00AE00A9

Strings

InitializeConditionVariable, xrefs: 00AE0148
kernel32.dll, xrefs: 00AE0133
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00AE0122
WakeAllConditionVariable, xrefs: 00AE0162
SleepConditionVariableCS, xrefs: 00AE0154

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 1d6ad2624c8636ac2b1db7659d0efc86c50c4752d82d826daeaec17a20320529
Instruction ID: 7d97d56e8279e1cc9eecbcd5747f24d0f021e5247a653f9d8ff9171997b8e194
Opcode Fuzzy Hash: 1d6ad2624c8636ac2b1db7659d0efc86c50c4752d82d826daeaec17a20320529
Instruction Fuzzy Hash: F421F6326447516FEB106BB5AD05F2A77E5EF05F62F0002BAF902A72E1DFB49C408A90

Function 00B230F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B2318D
_wcslen.LIBCMT ref: 00B231F8

Strings

INSTANCE, xrefs: 00B23453
TEXT, xrefs: 00B2347C
CLASS, xrefs: 00B23188, 00B231A5
NAME, xrefs: 00B23335, 00B23346
REGEXPCLASS, xrefs: 00B23255, 00B23266
CLASSNN, xrefs: 00B231F3, 00B23204

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 8d3cb694e0327e980b64d2ba48eeec13ca4803eb7702b460262c2162bf18a94a
Instruction ID: a25f1e6528b8e4235742f0b9adff8bac9cbe90a2addbdabfadffac691566ee6a
Opcode Fuzzy Hash: 8d3cb694e0327e980b64d2ba48eeec13ca4803eb7702b460262c2162bf18a94a
Instruction Fuzzy Hash: 42E1E532A005269BCB24DF64D491BEEBBF4FF14B10F54819AE45AB7250DB34AF85C790

Function 00B344C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00B5CC08), ref: 00B34527
_wcslen.LIBCMT ref: 00B3453B
_wcslen.LIBCMT ref: 00B34599
_wcslen.LIBCMT ref: 00B345F4
_wcslen.LIBCMT ref: 00B3463F
_wcslen.LIBCMT ref: 00B346A7

Part of subcall function 00ADF9F2: _wcslen.LIBCMT ref: 00ADF9FD

GetDriveTypeW.KERNEL32(?,00B86BF0,00000061), ref: 00B34743

Strings

unknown, xrefs: 00B34708
fixed, xrefs: 00B34635, 00B3463A
ramdisk, xrefs: 00B346F1
removable, xrefs: 00B345EA, 00B345EF
all, xrefs: 00B34531, 00B34536
cdrom, xrefs: 00B3458F, 00B34594
network, xrefs: 00B3469D, 00B346A2

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 1ace2e0b2564048ed7bcc3eeeb902a41d53697f84e43511e798d39a431ef2ffe
Instruction ID: 431034167e6ee09fe36d678be96d39c95920bae1569fb8e20cb6afe2e79231de
Opcode Fuzzy Hash: 1ace2e0b2564048ed7bcc3eeeb902a41d53697f84e43511e798d39a431ef2ffe
Instruction Fuzzy Hash: 84B1F0316083029FC710DF28C991A6EB7E5EFA5764F61499DF496C72A1E730EC44CB92

Function 00B43FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00B5CC08), ref: 00B440BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00B440CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00B5CC08), ref: 00B440F2
FreeLibrary.KERNEL32(00000000,?,00B5CC08), ref: 00B4413E
StringFromGUID2.OLE32(?,?,00000028,?,00B5CC08), ref: 00B441A8
SysFreeString.OLEAUT32(00000009), ref: 00B44262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00B442C8
SysFreeString.OLEAUT32(?), ref: 00B442F2

Strings

kernel32.dll, xrefs: 00B440B6
GetModuleHandleExW, xrefs: 00B440C7

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 4a967ba67fe76bff087b27c9222628c3a46db63b094a98965cea6392d131d542
Instruction ID: 1891ce9fcc2dc2af2d3597981751bb8efe345c6079d12d99f3b89bc12a1d4478
Opcode Fuzzy Hash: 4a967ba67fe76bff087b27c9222628c3a46db63b094a98965cea6392d131d542
Instruction Fuzzy Hash: 06122975A00219AFDB14CF94C884FAEBBF5FF45314F248098E905AB251DB31EE56DBA0

Function 00AC326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00B91990), ref: 00B02F8D
GetMenuItemCount.USER32(00B91990), ref: 00B0303D
GetCursorPos.USER32(?), ref: 00B03081
SetForegroundWindow.USER32(00000000), ref: 00B0308A
TrackPopupMenuEx.USER32(00B91990,00000000,?,00000000,00000000,00000000), ref: 00B0309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00B030A9

Strings

0, xrefs: 00AC327D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 20675df8507aa24e3acfeaf7ade21ee162250be5849ea2982083ba1e9e4863c2
Instruction ID: f55afa67efa028030ca873f6377d07130c507651c9b6a66615a7d837f46e4bfd
Opcode Fuzzy Hash: 20675df8507aa24e3acfeaf7ade21ee162250be5849ea2982083ba1e9e4863c2
Instruction Fuzzy Hash: F6710971640316BEEF218F64DC8DF9ABFA9FF04364F204256F519661E0CBB1A914DB50

Function 00B56CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00B56DEB

Part of subcall function 00AC6B57: _wcslen.LIBCMT ref: 00AC6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00B56E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00B56E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B56E94
DestroyWindow.USER32(?), ref: 00B56EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00AC0000,00000000), ref: 00B56EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B56EFD
GetDesktopWindow.USER32 ref: 00B56F16
GetWindowRect.USER32(00000000), ref: 00B56F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B56F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00B56F4D

Part of subcall function 00AD9944: GetWindowLongW.USER32(?,000000EB), ref: 00AD9952

Strings

0, xrefs: 00B56D98
tooltips_class32, xrefs: 00B56E58, 00B56EDD

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 912789dc6f0972983bffe36d8a10b79124beb5396442e8b3f44d8ebcec183042
Instruction ID: 14b1236d5d99e1e5fe53997ae04fa8448fdf7f11db805671480077f0c6592c82
Opcode Fuzzy Hash: 912789dc6f0972983bffe36d8a10b79124beb5396442e8b3f44d8ebcec183042
Instruction Fuzzy Hash: F0716770504345AFDB21CF18DC48FAABBE9FB99305F44099EF98987261CB70E90ADB11

Function 00B5911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AD9BB2

DragQueryPoint.SHELL32(?,?), ref: 00B59147

Part of subcall function 00B57674: ClientToScreen.USER32(?,?), ref: 00B5769A
Part of subcall function 00B57674: GetWindowRect.USER32(?,?), ref: 00B57710
Part of subcall function 00B57674: PtInRect.USER32(?,?,00B58B89), ref: 00B57720

SendMessageW.USER32(?,000000B0,?,?), ref: 00B591B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00B591BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00B591DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00B59225
SendMessageW.USER32(?,000000B0,?,?), ref: 00B5923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00B59255
SendMessageW.USER32(?,000000B1,?,?), ref: 00B59277
DragFinish.SHELL32(?), ref: 00B5927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00B59371

Strings

@GUI_DRAGFILE, xrefs: 00B59320
@GUI_DRAGID, xrefs: 00B592E9
@GUI_DROPID, xrefs: 00B5929E

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 6e8a1f082c77bf4e2e3ec1752b332072e72c2ba502ecd587ed049984f751abaf
Instruction ID: b637298d0dcf6f3cebfe979fb9465a5a79fbaf98cbd31f5b925cf5040207da06
Opcode Fuzzy Hash: 6e8a1f082c77bf4e2e3ec1752b332072e72c2ba502ecd587ed049984f751abaf
Instruction Fuzzy Hash: 48619C71108301AFC701EF65DD85EAFBBE9EF88750F0009AEF595932A0DB709A49CB52

Function 00B3C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B3C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00B3C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00B3C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00B3C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00B3C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00B3C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B3C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B3C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00B3C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00B3C5F0
InternetCloseHandle.WININET(00000000), ref: 00B3C5FB

Strings

, xrefs: 00B3C575

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 809f659bbd9e324b4652411447c9b7d13d54ad934a65ba14b827ff03dcd0597f
Instruction ID: 215e7d3e594c6d11dab3fd8369c7b52a3c8b9117c4d568db8054333daeadb2ec
Opcode Fuzzy Hash: 809f659bbd9e324b4652411447c9b7d13d54ad934a65ba14b827ff03dcd0597f
Instruction Fuzzy Hash: 155159B1500308BFEB219FA0C989AAB7FFDFB18745F204499F945A7610DB35E948DB60

Function 00B5856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00B58592
GetFileSize.KERNEL32(00000000,00000000), ref: 00B585A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00B585AD
CloseHandle.KERNEL32(00000000), ref: 00B585BA
GlobalLock.KERNEL32(00000000), ref: 00B585C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00B585D7
GlobalUnlock.KERNEL32(00000000), ref: 00B585E0
CloseHandle.KERNEL32(00000000), ref: 00B585E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00B585F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00B5FC38,?), ref: 00B58611
GlobalFree.KERNEL32(00000000), ref: 00B58621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00B58641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00B58671
DeleteObject.GDI32(00000000), ref: 00B58699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00B586AF

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: f318626aa6d7fab194ff9363a36612ccedde5d2140b77483eda5452f8661ccd6
Instruction ID: 0ea947318de435edd7db161cba146bf93e1a862c4c2c20f0107ce738edf791dd
Opcode Fuzzy Hash: f318626aa6d7fab194ff9363a36612ccedde5d2140b77483eda5452f8661ccd6
Instruction Fuzzy Hash: 2B41F975600308AFDB119FA5DC88FAA7BF9EF99712F144098F906E7260DB319945CF60

Function 00B314BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00B31502
VariantCopy.OLEAUT32(?,?), ref: 00B3150B
VariantClear.OLEAUT32(?), ref: 00B31517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00B315FB
VarR8FromDec.OLEAUT32(?,?), ref: 00B31657
VariantInit.OLEAUT32(?), ref: 00B31708
SysFreeString.OLEAUT32(?), ref: 00B3178C
VariantClear.OLEAUT32(?), ref: 00B317D8
VariantClear.OLEAUT32(?), ref: 00B317E7
VariantInit.OLEAUT32(00000000), ref: 00B31823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00B31625
Default, xrefs: 00B316AF

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 09cf4d63312bd4244f64414b6b4ab4aa16c88eb830178cce9b11470e029d28a2
Instruction ID: c5adfc8072cc3a6c2c73839f54759b5085024beaedb400e9fd3db688abeea13e
Opcode Fuzzy Hash: 09cf4d63312bd4244f64414b6b4ab4aa16c88eb830178cce9b11470e029d28a2
Instruction Fuzzy Hash: 83D1F171A00205EFDB10AF69D885B7DB7F9FF54700F25889AE446AB290DB30EC45DBA1

Function 00B4B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

Part of subcall function 00B4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B4B6AE,?,?), ref: 00B4C9B5
Part of subcall function 00B4C998: _wcslen.LIBCMT ref: 00B4C9F1
Part of subcall function 00B4C998: _wcslen.LIBCMT ref: 00B4CA68
Part of subcall function 00B4C998: _wcslen.LIBCMT ref: 00B4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B4B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B4B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00B4B80A
RegCloseKey.ADVAPI32(?), ref: 00B4B87E
RegCloseKey.ADVAPI32(?), ref: 00B4B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00B4B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B4B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00B4B922
FreeLibrary.KERNEL32(00000000), ref: 00B4B983
RegCloseKey.ADVAPI32(00000000), ref: 00B4B994

Strings

advapi32.dll, xrefs: 00B4B8ED
RegDeleteKeyExW, xrefs: 00B4B8FE

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: d60e16b4d979124d476d9c8730a5afb1e6442d162f71d4f382ad90e41e294de7
Instruction ID: 6e10907c4c33e76370f2f79ebf435d1d934570862dc6304cd0a1e7bf71a53139
Opcode Fuzzy Hash: d60e16b4d979124d476d9c8730a5afb1e6442d162f71d4f382ad90e41e294de7
Instruction Fuzzy Hash: ACC16C34208301AFD714DF24C495F2ABBE5FF84318F15859CE59A8B2A2CB71ED46DB91

Function 00B4255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B425D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00B425E8
CreateCompatibleDC.GDI32(?), ref: 00B425F4
SelectObject.GDI32(00000000,?), ref: 00B42601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00B4266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00B426AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00B426D0
SelectObject.GDI32(?,?), ref: 00B426D8
DeleteObject.GDI32(?), ref: 00B426E1
DeleteDC.GDI32(?), ref: 00B426E8
ReleaseDC.USER32(00000000,?), ref: 00B426F3

Strings

(, xrefs: 00B4268D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 6dfb926b4a91d95adf0ac224af1ac444089931f770365e873e734040fad4055d
Instruction ID: d70ef38941f86a560e20c357030913b6cbecb65bbf5a57a2bebbbe6e3b2e6e19
Opcode Fuzzy Hash: 6dfb926b4a91d95adf0ac224af1ac444089931f770365e873e734040fad4055d
Instruction Fuzzy Hash: AB61D175D00219EFCF04CFA8D884AAEBBF6FF48310F24856AE956A7250D770AA51DF50

Function 00AFDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00AFDAA1

Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD659
Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD66B
Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD67D
Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD68F
Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD6A1
Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD6B3
Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD6C5
Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD6D7
Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD6E9
Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD6FB
Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD70D
Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD71F
Part of subcall function 00AFD63C: _free.LIBCMT ref: 00AFD731

_free.LIBCMT ref: 00AFDA96

Part of subcall function 00AF29C8: HeapFree.KERNEL32(00000000,00000000,?,00AFD7D1,00000000,00000000,00000000,00000000,?,00AFD7F8,00000000,00000007,00000000,?,00AFDBF5,00000000), ref: 00AF29DE
Part of subcall function 00AF29C8: GetLastError.KERNEL32(00000000,?,00AFD7D1,00000000,00000000,00000000,00000000,?,00AFD7F8,00000000,00000007,00000000,?,00AFDBF5,00000000,00000000), ref: 00AF29F0

_free.LIBCMT ref: 00AFDAB8
_free.LIBCMT ref: 00AFDACD
_free.LIBCMT ref: 00AFDAD8
_free.LIBCMT ref: 00AFDAFA
_free.LIBCMT ref: 00AFDB0D
_free.LIBCMT ref: 00AFDB1B
_free.LIBCMT ref: 00AFDB26
_free.LIBCMT ref: 00AFDB5E
_free.LIBCMT ref: 00AFDB65
_free.LIBCMT ref: 00AFDB82
_free.LIBCMT ref: 00AFDB9A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 1d2d8570b7d6e9fdf5e7dd47d753c41b1359b5659a39e5c2ea26754549038fb1
Instruction ID: ad2179bfb65eea8e41cce703c92ec1cd00784ef38887224f04c1e7285570ecc8
Opcode Fuzzy Hash: 1d2d8570b7d6e9fdf5e7dd47d753c41b1359b5659a39e5c2ea26754549038fb1
Instruction Fuzzy Hash: 5F31693264420A9FEB22ABB8E985B7A77EAFF40350F104519F288D7191DB71AC408724

Function 00B2365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00B2369C
_wcslen.LIBCMT ref: 00B236A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00B23797
GetClassNameW.USER32(?,?,00000400), ref: 00B2380C
GetDlgCtrlID.USER32(?), ref: 00B2385D
GetWindowRect.USER32(?,?), ref: 00B23882
GetParent.USER32(?), ref: 00B238A0
ScreenToClient.USER32(00000000), ref: 00B238A7
GetClassNameW.USER32(?,?,00000100), ref: 00B23921
GetWindowTextW.USER32(?,?,00000400), ref: 00B2395D

Strings

%s%u, xrefs: 00B23734

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 8204504855725b3306f4ed8297d6cf3b2d587b923e22a4bcf558c2805a2eb283
Instruction ID: f74b2766cc81301fa489a6b878c922725b2dec934edaf16f436f9ae7b39cd64f
Opcode Fuzzy Hash: 8204504855725b3306f4ed8297d6cf3b2d587b923e22a4bcf558c2805a2eb283
Instruction Fuzzy Hash: D691D171204316AFD719DF24E884FAAB7E9FF44700F008559F99EC6190DB38EA45CB91

Function 00B24954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00B24994
GetWindowTextW.USER32(?,?,00000400), ref: 00B249DA
_wcslen.LIBCMT ref: 00B249EB
CharUpperBuffW.USER32(?,00000000), ref: 00B249F7
_wcsstr.LIBVCRUNTIME ref: 00B24A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00B24A64
GetWindowTextW.USER32(?,?,00000400), ref: 00B24A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00B24AE6
GetClassNameW.USER32(?,?,00000400), ref: 00B24B20
GetWindowRect.USER32(?,?), ref: 00B24B8B

Strings

ThumbnailClass, xrefs: 00B24A6F, 00B24AF1

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 044193a1c1b277b81991623ca22b2a706f04ad85b6de9bcc43398a404bf1eb68
Instruction ID: 7e1e2bb2344f41b61558323923793da0c41f78346ebeb208a47e6529e04f14f2
Opcode Fuzzy Hash: 044193a1c1b277b81991623ca22b2a706f04ad85b6de9bcc43398a404bf1eb68
Instruction Fuzzy Hash: 4391BC311083169FDB04DF14E985BAA7BE8FF84314F0484A9FD899B496DB30ED45CBA1

Function 00B2BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00B91990,000000FF,00000000,00000030), ref: 00B2BFAC
SetMenuItemInfoW.USER32(00B91990,00000004,00000000,00000030), ref: 00B2BFE1
Sleep.KERNEL32(000001F4), ref: 00B2BFF3
GetMenuItemCount.USER32(?), ref: 00B2C039
GetMenuItemID.USER32(?,00000000), ref: 00B2C056
GetMenuItemID.USER32(?,-00000001), ref: 00B2C082
GetMenuItemID.USER32(?,?), ref: 00B2C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B2C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B2C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B2C145

Strings

0, xrefs: 00B2BF3D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 41842fee09c4b59280942bca8e1d1bc53f63e72842bdeaf569c9cb41804c7f65
Instruction ID: 55bd55413908ad18e82ad64a41947e9df45f2a410543ddc2175806f5d8c46462
Opcode Fuzzy Hash: 41842fee09c4b59280942bca8e1d1bc53f63e72842bdeaf569c9cb41804c7f65
Instruction Fuzzy Hash: BF618CB090036AAFDF11CF68ED89AAE7FF9EF05345F104195E819A3291DB35AD14CB60

Function 00B4CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00B4CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00B4CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00B4CD48

Part of subcall function 00B4CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00B4CCAA
Part of subcall function 00B4CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00B4CCBD
Part of subcall function 00B4CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B4CCCF
Part of subcall function 00B4CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00B4CD05
Part of subcall function 00B4CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00B4CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00B4CCF3

Strings

advapi32.dll, xrefs: 00B4CCB8
RegDeleteKeyExW, xrefs: 00B4CCC9

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 039484d8ad147af6272e3eff91292acbff27a84668297f43352ee77b76fe6ea5
Instruction ID: 63fb817670e23bdb6df47295e733108d763f0c14502fb5fd395d2f02f5c21eb2
Opcode Fuzzy Hash: 039484d8ad147af6272e3eff91292acbff27a84668297f43352ee77b76fe6ea5
Instruction Fuzzy Hash: E5318E71902229BFDB609B51DC88EFFBFBDEF05B51F0001A5A905E3251DB309B45EAA0

Function 00B33D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00B33D40
_wcslen.LIBCMT ref: 00B33D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B33D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00B33DBE
RemoveDirectoryW.KERNEL32(?), ref: 00B33DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00B33E55
CloseHandle.KERNEL32(00000000), ref: 00B33E60
CloseHandle.KERNEL32(00000000), ref: 00B33E6B

Strings

\??\%s, xrefs: 00B33D5B
\, xrefs: 00B33D77
:, xrefs: 00B33D82

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 353f14fd2a3c1143e858f51a0680721bd3d2f5c797b27adf122cd1256267084b
Instruction ID: c59de21ff19dbec5ca0cb6c7f2678bb8962925a44d5127dd28f24189ddb89c40
Opcode Fuzzy Hash: 353f14fd2a3c1143e858f51a0680721bd3d2f5c797b27adf122cd1256267084b
Instruction Fuzzy Hash: 07317071900259AADB219FA0DC49FEB37FDEF88B01F2041F6F609D6160EB7497848B64

Function 00B2E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00B2E6B4

Part of subcall function 00ADE551: timeGetTime.WINMM(?,?,00B2E6D4), ref: 00ADE555

Sleep.KERNEL32(0000000A), ref: 00B2E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00B2E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00B2E727
SetActiveWindow.USER32 ref: 00B2E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00B2E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00B2E773
Sleep.KERNEL32(000000FA), ref: 00B2E77E
IsWindow.USER32 ref: 00B2E78A
EndDialog.USER32(00000000), ref: 00B2E79B

Strings

BUTTON, xrefs: 00B2E719

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: aa3c4745322ae639a7a9b3e2b9879b022db93578995f61ec78f470458ace0d9a
Instruction ID: b9dda482d7cf665cd560f07b696d4f4d5887f31b0acd044e5b8576703c89ca60
Opcode Fuzzy Hash: aa3c4745322ae639a7a9b3e2b9879b022db93578995f61ec78f470458ace0d9a
Instruction Fuzzy Hash: 66219F70204311BFEB015F61FD89B253FAAE75574AB1044A6F52A836B2DF71EC009A24

Function 00B2E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00B2EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00B2EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B2EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00B2EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00B2EAA7

Strings

play PlayMe wait, xrefs: 00B2EA91
status PlayMe mode, xrefs: 00B2EA58
open , xrefs: 00B2EA0C
alias PlayMe, xrefs: 00B2EA36
close PlayMe, xrefs: 00B2EA6E, 00B2EA9B
play PlayMe, xrefs: 00B2EAA2

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: e8cb78079bed6eca4475d2d6353655a752e96c6c7dddfa3725b0134738654f61
Instruction ID: bbab731a60276b574f753193135e5b70cf9b9b666bc000891d4fa9f95f79b8ac
Opcode Fuzzy Hash: e8cb78079bed6eca4475d2d6353655a752e96c6c7dddfa3725b0134738654f61
Instruction Fuzzy Hash: A3117331A5026979D720B7A2ED4AEFF6BFCEBD6B00F4004A9B415A21F1EE704D05C6B0

Function 00B29F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B2A012
SetKeyboardState.USER32(?), ref: 00B2A07D
GetAsyncKeyState.USER32(000000A0), ref: 00B2A09D
GetKeyState.USER32(000000A0), ref: 00B2A0B4
GetAsyncKeyState.USER32(000000A1), ref: 00B2A0E3
GetKeyState.USER32(000000A1), ref: 00B2A0F4
GetAsyncKeyState.USER32(00000011), ref: 00B2A120
GetKeyState.USER32(00000011), ref: 00B2A12E
GetAsyncKeyState.USER32(00000012), ref: 00B2A157
GetKeyState.USER32(00000012), ref: 00B2A165
GetAsyncKeyState.USER32(0000005B), ref: 00B2A18E
GetKeyState.USER32(0000005B), ref: 00B2A19C

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: f8f494554127dd6193e51da40d08acff3ed42d25c290b9178ad9632e862c9568
Instruction ID: 705870c3f68be2c5e95725e8d69e3728eed6f0f7a9b0b4c0f0d9ed3ebd23e72b
Opcode Fuzzy Hash: f8f494554127dd6193e51da40d08acff3ed42d25c290b9178ad9632e862c9568
Instruction Fuzzy Hash: 70511B205047A46AFB35DBA0A9107EBBFF5DF12340F0845D9D5CE571C2DA54AA4CCB63

Function 00B25CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00B25CE2
GetWindowRect.USER32(00000000,?), ref: 00B25CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00B25D59
GetDlgItem.USER32(?,00000002), ref: 00B25D69
GetWindowRect.USER32(00000000,?), ref: 00B25D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00B25DCF
GetDlgItem.USER32(?,000003E9), ref: 00B25DDD
GetWindowRect.USER32(00000000,?), ref: 00B25DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00B25E31
GetDlgItem.USER32(?,000003EA), ref: 00B25E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00B25E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00B25E67

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: d2cb131a503da73282eaf99e65bbb9b981ac036cc684c851c70f803d8066ab34
Instruction ID: f8277f4606a76b4a6060f53d2c11820b3540b763a358efa02332283eb6a73228
Opcode Fuzzy Hash: d2cb131a503da73282eaf99e65bbb9b981ac036cc684c851c70f803d8066ab34
Instruction Fuzzy Hash: 7D51FE71A00715AFDB18DF68DD89AAEBBF6FB48301F148169F519E7290DB709E04CB50

Function 00AD8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AD8BE8,?,00000000,?,?,?,?,00AD8BBA,00000000,?), ref: 00AD8FC5

DestroyWindow.USER32(?), ref: 00AD8C81
KillTimer.USER32(00000000,?,?,?,?,00AD8BBA,00000000,?), ref: 00AD8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00B16973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00AD8BBA,00000000,?), ref: 00B169A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00AD8BBA,00000000,?), ref: 00B169B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00AD8BBA,00000000), ref: 00B169D4
DeleteObject.GDI32(00000000), ref: 00B169E6

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 89a746d60e43fec9a002e8558a5c4aeebd07f43b98fc759d86633796817df637
Instruction ID: b2c4540712aac541738d731afb60d70904515bee069a4c724031c551249eecb6
Opcode Fuzzy Hash: 89a746d60e43fec9a002e8558a5c4aeebd07f43b98fc759d86633796817df637
Instruction Fuzzy Hash: 96617D31512701DFCB259F18DA48B697BF2FF44312F54899AE04397AA0CB39AD91DF60

Function 00AD9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00AD9944: GetWindowLongW.USER32(?,000000EB), ref: 00AD9952

GetSysColor.USER32(0000000F), ref: 00AD9862

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: cdb997822417e5cca22cc595d6140ca4496836bc82d94d0264c5d88d64392d74
Instruction ID: 2bf7b0533ac96b6b1a37da8e21b02715848a66b4984a5e44b7c419cf88bb6547
Opcode Fuzzy Hash: cdb997822417e5cca22cc595d6140ca4496836bc82d94d0264c5d88d64392d74
Instruction Fuzzy Hash: AE4171311447409FDB205F389C84BBA3BB6EB16721F544656F9A3972E1DB31D942EB10

Function 00B296E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00B0F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00B29717
LoadStringW.USER32(00000000,?,00B0F7F8,00000001), ref: 00B29720

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00B0F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00B29742
LoadStringW.USER32(00000000,?,00B0F7F8,00000001), ref: 00B29745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00B29866

Strings

Line %d:, xrefs: 00B297A0
Line %d (File "%s"):, xrefs: 00B2978F
Error: , xrefs: 00B2981D
^ ERROR, xrefs: 00B297FB
%s (%d) : ==> %s: %s %s, xrefs: 00B2984A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: a11730316a09990e407929c9b9cecbd2e47d635e674df386709987bc99912d58
Instruction ID: 7fc28a71bc1648c9acee8737c8a4f20495d081b9cec0749c0ded6e073158e0a2
Opcode Fuzzy Hash: a11730316a09990e407929c9b9cecbd2e47d635e674df386709987bc99912d58
Instruction Fuzzy Hash: C7414072900219AADF04FBE0DE46EEE77B8AF15340F150169F50976192EB355F48CB61

Function 00B206DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC6B57: _wcslen.LIBCMT ref: 00AC6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00B207A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00B207BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00B207DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00B20804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00B2082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B20837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B2083C

Strings

SOFTWARE\Classes\, xrefs: 00B2070E
\IPC$, xrefs: 00B20784
\CLSID, xrefs: 00B20724

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 0fda4973ed4d235b80b5029562c3b04fc942153e36df39897060dcc1f8b0916b
Instruction ID: 87bfb1754aff3d98454792295fc84d50a48e14e07984d782e5cb1ee252e129df
Opcode Fuzzy Hash: 0fda4973ed4d235b80b5029562c3b04fc942153e36df39897060dcc1f8b0916b
Instruction Fuzzy Hash: 51410872C10229ABDF21EFA4DD85EEEB7B8FF14350F054169E905A71A1EB309E04CB90

Function 00B53F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00B5403B
CreateCompatibleDC.GDI32(00000000), ref: 00B54042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00B54055
SelectObject.GDI32(00000000,00000000), ref: 00B5405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00B54068
DeleteDC.GDI32(00000000), ref: 00B54072
GetWindowLongW.USER32(?,000000EC), ref: 00B5407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00B54092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00B5409E

Strings

static, xrefs: 00B53FD3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: daa659f0db797b1a2e7ed90be3926e741accca0fc9c19541d13284ab810cfb21
Instruction ID: 09906cd3a4b6c53102fe10551d3f4c695cb5454dfcb5321b156d477b5c20d84d
Opcode Fuzzy Hash: daa659f0db797b1a2e7ed90be3926e741accca0fc9c19541d13284ab810cfb21
Instruction Fuzzy Hash: 1B317A32500319AFDF229FA4DC49FDA3FA9EF0D326F110291FA19A61A0CB35D855DB60

Function 00B43C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B43C5C
CoInitialize.OLE32(00000000), ref: 00B43C8A
CoUninitialize.OLE32 ref: 00B43C94
_wcslen.LIBCMT ref: 00B43D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00B43DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00B43ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00B43F0E
CoGetObject.OLE32(?,00000000,00B5FB98,?), ref: 00B43F2D
SetErrorMode.KERNEL32(00000000), ref: 00B43F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00B43FC4
VariantClear.OLEAUT32(?), ref: 00B43FD8

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 11799a5ccc3c94c13d12d32401cc1876c0933b41fd0f0462192aaa2a4b319312
Instruction ID: 6365d7f160d600d1746014c498c157ee4bfe4f5108f6847bbcb28bc3beb947e6
Opcode Fuzzy Hash: 11799a5ccc3c94c13d12d32401cc1876c0933b41fd0f0462192aaa2a4b319312
Instruction Fuzzy Hash: 42C159716083059FD700DF64C88492BBBE9FF89B44F14499DF98A9B211DB31EE05DB52

Function 00B37A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B37AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00B37B8F
SHGetDesktopFolder.SHELL32(?), ref: 00B37BA3
CoCreateInstance.OLE32(00B5FD08,00000000,00000001,00B86E6C,?), ref: 00B37BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00B37C74
CoTaskMemFree.OLE32(?,?), ref: 00B37CCC
SHBrowseForFolderW.SHELL32(?), ref: 00B37D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00B37D7A
CoTaskMemFree.OLE32(00000000), ref: 00B37D81
CoTaskMemFree.OLE32(00000000), ref: 00B37DD6
CoUninitialize.OLE32 ref: 00B37DDC

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: cdb16fcd24083355129ba1c8e5ad88857f8e7b9b0cd389457d0963f7c4cd2328
Instruction ID: a1027424b8242c4bd693889980762bd132494c9c104243e15d7669b262546c30
Opcode Fuzzy Hash: cdb16fcd24083355129ba1c8e5ad88857f8e7b9b0cd389457d0963f7c4cd2328
Instruction Fuzzy Hash: 5DC10C75A04209AFCB14DF64C884EAEBBF9FF48304F1584A9E9169B361DB31ED45CB90

Function 00B5541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00B55504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B55515
CharNextW.USER32(00000158), ref: 00B55544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00B55585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00B5559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B555AC

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: be9c803c279dde0011d6a954b27ed389cd63510507f53e0efef8e60980c268cf
Instruction ID: b044faded337764e23596d2a709b508bb5c173f738113a36483105b093337b12
Opcode Fuzzy Hash: be9c803c279dde0011d6a954b27ed389cd63510507f53e0efef8e60980c268cf
Instruction Fuzzy Hash: 91617D70900609EFDF209F54CC95BFE7BB9EB09323F1041C5F925A7290DB749A889B60

Function 00B1FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00B1FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00B1FB08
VariantInit.OLEAUT32(?), ref: 00B1FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00B1FB3A
VariantCopy.OLEAUT32(?,?), ref: 00B1FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00B1FBA1
VariantClear.OLEAUT32(?), ref: 00B1FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00B1FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B1FBCC
VariantClear.OLEAUT32(?), ref: 00B1FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B1FBE9

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 563562ca21c418af834728d81a9bab624391258cd55ec97d6dbf0db76f012874
Instruction ID: fd4fbc8b044d52af5b9523ea07e31e834a46c04a663fba98e2c56484a573f944
Opcode Fuzzy Hash: 563562ca21c418af834728d81a9bab624391258cd55ec97d6dbf0db76f012874
Instruction Fuzzy Hash: 61414F75A0031A9FCB00DF64D854EFEBBBAEF48355F4080A9E955A7261CB30A946CB90

Function 00B29C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B29CA1
GetAsyncKeyState.USER32(000000A0), ref: 00B29D22
GetKeyState.USER32(000000A0), ref: 00B29D3D
GetAsyncKeyState.USER32(000000A1), ref: 00B29D57
GetKeyState.USER32(000000A1), ref: 00B29D6C
GetAsyncKeyState.USER32(00000011), ref: 00B29D84
GetKeyState.USER32(00000011), ref: 00B29D96
GetAsyncKeyState.USER32(00000012), ref: 00B29DAE
GetKeyState.USER32(00000012), ref: 00B29DC0
GetAsyncKeyState.USER32(0000005B), ref: 00B29DD8
GetKeyState.USER32(0000005B), ref: 00B29DEA

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 62b58490edb0cc926dba3a562497932d0c107118cd33ebdd4c16212a6a6f4223
Instruction ID: 97e8deeb057d8564b547d01eec5a3ec5fe22d765e3ad55390a0c4aa73e1fffbd
Opcode Fuzzy Hash: 62b58490edb0cc926dba3a562497932d0c107118cd33ebdd4c16212a6a6f4223
Instruction Fuzzy Hash: 4C41F6345047D96DFF359660E8043B5BEE1EF21344F0480EACACE571C2EBA499C8C7A2

Function 00B4055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00B405BC
inet_addr.WSOCK32(?), ref: 00B4061C
gethostbyname.WSOCK32(?), ref: 00B40628
IcmpCreateFile.IPHLPAPI ref: 00B40636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00B406C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00B406E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00B407B9
WSACleanup.WSOCK32 ref: 00B407BF

Strings

Ping, xrefs: 00B40676

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 4304f308cd34d43a1d106ba504bc852d5f303a9f2b2e712279e7408d9d83d76f
Instruction ID: 0f6c2fc70096ad7575b3274bde8778ef9827dcf100e648554d727d157d4b22df
Opcode Fuzzy Hash: 4304f308cd34d43a1d106ba504bc852d5f303a9f2b2e712279e7408d9d83d76f
Instruction Fuzzy Hash: F391AD356183019FD720EF15C588F1ABBE0EF44318F0585A9E56A8B7A2CB30EE41DF92

Function 00B48CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00B48CF3

Part of subcall function 00B28E54: _wcslen.LIBCMT ref: 00B28E77

_wcslen.LIBCMT ref: 00B48D4E
_wcslen.LIBCMT ref: 00B48D9C
_wcslen.LIBCMT ref: 00B48DDC
_wcslen.LIBCMT ref: 00B48E6E

Strings

winapi, xrefs: 00B48D96, 00B48D9B
cdecl, xrefs: 00B48D48, 00B48D4D
stdcall, xrefs: 00B48DD6, 00B48DDB
none, xrefs: 00B48E65, 00B48E6A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 1fe7df19f0a205898c7aedf0fe358a17ab2d2fd4f855ebb281f129bae39fe062
Instruction ID: 84e37a55c31cdad97587961cacdfd04ea6d1e54ca345e43c86ca3d8a8016b031
Opcode Fuzzy Hash: 1fe7df19f0a205898c7aedf0fe358a17ab2d2fd4f855ebb281f129bae39fe062
Instruction Fuzzy Hash: ED518032A011169BCB14EF6CC9809BEB7E6FF64724B2142A9E426E7285DF31DE40D7D0

Function 00B4372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00B43774
CoUninitialize.OLE32 ref: 00B4377F
CoCreateInstance.OLE32(?,00000000,00000017,00B5FB78,?), ref: 00B437D9
IIDFromString.OLE32(?,?), ref: 00B4384C
VariantInit.OLEAUT32(?), ref: 00B438E4
VariantClear.OLEAUT32(?), ref: 00B43936

Strings

Failed to create object, xrefs: 00B437E4, 00B4389A
Invalid parameter, xrefs: 00B43865
NULL Pointer assignment, xrefs: 00B4381E

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: abcf3d3c2c6141742b3630db3aac87bb12687313cdfe4be45f9bbf5870b192f3
Instruction ID: b7ab5f89f295f7a4e68c1c27f2be302d8e3082f88aeadf554963031aac251379
Opcode Fuzzy Hash: abcf3d3c2c6141742b3630db3aac87bb12687313cdfe4be45f9bbf5870b192f3
Instruction Fuzzy Hash: 8561A070608301AFD710DF54C889F6ABBE4EF49B15F144889F485972A1CB70EF48DB92

Function 00B33388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00B333CF

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00B333F0

Strings

^ ERROR , xrefs: 00B3349E
Incorrect parameters to object property !, xrefs: 00B334AB
Line %d (File "%s"):, xrefs: 00B33443, 00B3345C
"%s" (%d) : ==> %s:%s%s, xrefs: 00B33504
Error: , xrefs: 00B334D1
"%s" (%d) : ==> %s:, xrefs: 00B33522

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 3726c505f55bceb183998afe91149ee4ac9c95b02847c0bf3cd3e73255011da4
Instruction ID: ee4cb4bc1770866daadc5ca9c9fcdacb7d663ff88c713e5592639c06251bbc3e
Opcode Fuzzy Hash: 3726c505f55bceb183998afe91149ee4ac9c95b02847c0bf3cd3e73255011da4
Instruction Fuzzy Hash: E0518032900209BADF15EBA0DE46EEEB7B8EF14740F2141A9F40973161DB316F58DB61

Function 00B2B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B2B5FC
_wcslen.LIBCMT ref: 00B2B608
_wcslen.LIBCMT ref: 00B2B64D
_wcslen.LIBCMT ref: 00B2B68C
_wcslen.LIBCMT ref: 00B2B6C7

Strings

KEYS, xrefs: 00B2B647, 00B2B64C
REMOVE, xrefs: 00B2B602, 00B2B607
APPEND, xrefs: 00B2B6C1, 00B2B6C6
EXISTS, xrefs: 00B2B686, 00B2B68B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: fdc384ac8063a4d7f8ae79b5522780910b87ce7031aeb0a9a2fb0d0c9c73d1ba
Instruction ID: 998344c072c6bb2425ebe092af3981e868f7090f4136686b2a5572bb9c0ca77e
Opcode Fuzzy Hash: fdc384ac8063a4d7f8ae79b5522780910b87ce7031aeb0a9a2fb0d0c9c73d1ba
Instruction Fuzzy Hash: 5841E532A001369ACB206F7DD9909BEB7E5EB60754B2442A9E42AD7284EB31CD81C790

Function 00B35393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B353A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00B35416
GetLastError.KERNEL32 ref: 00B35420
SetErrorMode.KERNEL32(00000000,READY), ref: 00B354A7

Strings

READY, xrefs: 00B35460, 00B35468
NOTREADY, xrefs: 00B3544B
UNKNOWN, xrefs: 00B35444
INVALID, xrefs: 00B35459
READONLY, xrefs: 00B35452

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 511a468907d97e3777760cb6fbf6507d412b4b600a3228037bb0cecf41331c54
Instruction ID: 04e00420eda09028749bc10f1784b91c82ee4e42fefb385c9cc885decbda7d67
Opcode Fuzzy Hash: 511a468907d97e3777760cb6fbf6507d412b4b600a3228037bb0cecf41331c54
Instruction Fuzzy Hash: 05319235A006089FD724DF68C584FAA7BF4EF45305F2480A9E805DB3A6DB71DD86CB91

Function 00B53C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00B53C79
SetMenu.USER32(?,00000000), ref: 00B53C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B53D10
IsMenu.USER32(?), ref: 00B53D24
CreatePopupMenu.USER32 ref: 00B53D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B53D5B
DrawMenuBar.USER32 ref: 00B53D63

Strings

0, xrefs: 00B53C54
F, xrefs: 00B53D4E

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 0896165c5a8cabe57087cb0689417e06c454a88b09fba2d17d18da23046bb147
Instruction ID: 9b8f66ea130e905c558c53a125ab34db4a1a98b089c84da54d9271b149051aac
Opcode Fuzzy Hash: 0896165c5a8cabe57087cb0689417e06c454a88b09fba2d17d18da23046bb147
Instruction Fuzzy Hash: 16417C75A01309AFDB14CF94D844B9A7BF5FF49341F1400A9ED16973A0D770AA14CF50

Function 00B21EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

Part of subcall function 00B23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B23CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00B21F64
GetDlgCtrlID.USER32 ref: 00B21F6F
GetParent.USER32 ref: 00B21F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B21F8E
GetDlgCtrlID.USER32(?), ref: 00B21F97
GetParent.USER32(?), ref: 00B21FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B21FAE

Strings

ListBox, xrefs: 00B21F21
ComboBox, xrefs: 00B21EEC

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 1a5c76349b9f4d2306902c4c205f4e091f5d79cd5a6c0de62b05cf894b5872df
Instruction ID: 551f7230c66c7ecc74db831bcf4affe0c6054ddc3531107f9f2bf1a5f3b2b326
Opcode Fuzzy Hash: 1a5c76349b9f4d2306902c4c205f4e091f5d79cd5a6c0de62b05cf894b5872df
Instruction Fuzzy Hash: 3621B070900324BFCF04AFA4DD85EEEBBF9EF29310F004599B965672A1CB345A14DB60

Function 00B21FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

Part of subcall function 00B23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B23CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00B22043
GetDlgCtrlID.USER32 ref: 00B2204E
GetParent.USER32 ref: 00B2206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B2206D
GetDlgCtrlID.USER32(?), ref: 00B22076
GetParent.USER32(?), ref: 00B2208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B2208D

Strings

ListBox, xrefs: 00B22002
ComboBox, xrefs: 00B21FCD

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: ba5f44a324414198a56c89a175b70969f9590002630ff9278782d4cd0425e1e4
Instruction ID: 11a59e4958ddb1db9ff84d51d43c2f51c43cf0ff655e4690b77f4ee61445246e
Opcode Fuzzy Hash: ba5f44a324414198a56c89a175b70969f9590002630ff9278782d4cd0425e1e4
Instruction Fuzzy Hash: 3521BE71900328BFCB10AFA0DC89EEFBFF9EB19300F000495B955A71A1CA795A14DB60

Function 00B53A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00B53A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00B53AA0
GetWindowLongW.USER32(?,000000F0), ref: 00B53AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B53AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00B53B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00B53BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00B53BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00B53BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00B53BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00B53C13

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 5a549f2538b8a6dc8e83e162f936d76569daafe3d60699d33e5f3fc948f22a38
Instruction ID: c7536c0d40fb63e9ed862ef0585d1e5fa3a808fae697f31d507d7aaae6f7d648
Opcode Fuzzy Hash: 5a549f2538b8a6dc8e83e162f936d76569daafe3d60699d33e5f3fc948f22a38
Instruction Fuzzy Hash: 5B615775A00248AFDB11DFA8CD81FEE77F8EB09700F10459AFA15A72A1C770AE45DB50

Function 00B2B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B2B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00B2A1E1,?,00000001), ref: 00B2B165
GetWindowThreadProcessId.USER32(00000000), ref: 00B2B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B2A1E1,?,00000001), ref: 00B2B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B2B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00B2A1E1,?,00000001), ref: 00B2B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B2A1E1,?,00000001), ref: 00B2B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00B2A1E1,?,00000001), ref: 00B2B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00B2A1E1,?,00000001), ref: 00B2B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00B2A1E1,?,00000001), ref: 00B2B21D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: e4ff6a6a2a3d9fea1cad1d948e714c35463c73ec85e0ae898dbcd5a35e54a436
Instruction ID: fbcb29b545c34e1600a884af07ff453bc7ac10b6d8609a79a3ba2c25640e0c4d
Opcode Fuzzy Hash: e4ff6a6a2a3d9fea1cad1d948e714c35463c73ec85e0ae898dbcd5a35e54a436
Instruction Fuzzy Hash: C4316771520314EFDB109F24ED98F6E7FEAEB52712F204086FA09A7191DFB49A40CB64

Function 00AF2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00AF2C94

Part of subcall function 00AF29C8: HeapFree.KERNEL32(00000000,00000000,?,00AFD7D1,00000000,00000000,00000000,00000000,?,00AFD7F8,00000000,00000007,00000000,?,00AFDBF5,00000000), ref: 00AF29DE
Part of subcall function 00AF29C8: GetLastError.KERNEL32(00000000,?,00AFD7D1,00000000,00000000,00000000,00000000,?,00AFD7F8,00000000,00000007,00000000,?,00AFDBF5,00000000,00000000), ref: 00AF29F0

_free.LIBCMT ref: 00AF2CA0
_free.LIBCMT ref: 00AF2CAB
_free.LIBCMT ref: 00AF2CB6
_free.LIBCMT ref: 00AF2CC1
_free.LIBCMT ref: 00AF2CCC
_free.LIBCMT ref: 00AF2CD7
_free.LIBCMT ref: 00AF2CE2
_free.LIBCMT ref: 00AF2CED
_free.LIBCMT ref: 00AF2CFB

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: cd8f08aa8231e6c9cc9d34a6304df3bb4bdfde78519ee8cccc3a20a4b4a6aa8e
Instruction ID: e8973e780dc05e3d80b474feef55fe5287faf3c54701bd903f5077c6a05efc20
Opcode Fuzzy Hash: cd8f08aa8231e6c9cc9d34a6304df3bb4bdfde78519ee8cccc3a20a4b4a6aa8e
Instruction Fuzzy Hash: E011B67614010DBFCB02EF94DA82EED3BA5FF45350F4144A5FA889F222DA71EE509B90

Function 00AC1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00AC1459
OleUninitialize.OLE32(?,00000000), ref: 00AC14F8
UnregisterHotKey.USER32(?), ref: 00AC16DD
DestroyWindow.USER32(?), ref: 00B024B9
FreeLibrary.KERNEL32(?), ref: 00B0251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00B0254B

Strings

close all, xrefs: 00AC1454

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 6bba1293415f87f4ceed03521a32f8ff5353096bf5941217a4caf2168cff1051
Instruction ID: 2b707d5c6b4a1e2d8aebbbb02d5648902993d512f8e86f95964e0a209648a3ae
Opcode Fuzzy Hash: 6bba1293415f87f4ceed03521a32f8ff5353096bf5941217a4caf2168cff1051
Instruction Fuzzy Hash: 58D159317012128FCB19EF14C999F29FBA5BF05700F2542EDE84A6B292DB31AD16CF95

Function 00B37DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B37FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00B37FC1
GetFileAttributesW.KERNEL32(?), ref: 00B37FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00B38005
SetCurrentDirectoryW.KERNEL32(?), ref: 00B38017
SetCurrentDirectoryW.KERNEL32(?), ref: 00B38060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00B380B0

Strings

*.*, xrefs: 00B38066

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 5795c4788a2f872ec5d489896928139ebdd94b96b7d4973b6edddaef76277a5b
Instruction ID: d38a1fb6cb0d063d70324164f42b8e3a1240279c056880cc73b6af8711cafd77
Opcode Fuzzy Hash: 5795c4788a2f872ec5d489896928139ebdd94b96b7d4973b6edddaef76277a5b
Instruction Fuzzy Hash: D98181B15483559BCB34DF14C484AAEB7E9FF88310F24489EF889D7250EB35DD498B92

Function 00AC5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00AC5C7A

Part of subcall function 00AC5D0A: GetClientRect.USER32(?,?), ref: 00AC5D30
Part of subcall function 00AC5D0A: GetWindowRect.USER32(?,?), ref: 00AC5D71
Part of subcall function 00AC5D0A: ScreenToClient.USER32(?,?), ref: 00AC5D99

GetDC.USER32 ref: 00B046F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00B04708
SelectObject.GDI32(00000000,00000000), ref: 00B04716
SelectObject.GDI32(00000000,00000000), ref: 00B0472B
ReleaseDC.USER32(?,00000000), ref: 00B04733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00B047C4

Strings

U, xrefs: 00B04693

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 88c9b24d9958a8b08b6c6edc9171f26d9ba46c1185e3664b7b464333fa56c055
Instruction ID: ba8c908145c2238509b828c421dd4f6ef1ae00a8549484a8b2d2764a3cbd4d1c
Opcode Fuzzy Hash: 88c9b24d9958a8b08b6c6edc9171f26d9ba46c1185e3664b7b464333fa56c055
Instruction Fuzzy Hash: D471BF71800205DFCF218F64C984AAA7FF5FF4A351F1442A9EE565A2A6DB319C81DF50

Function 00B3359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00B335E4

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

LoadStringW.USER32(00B92390,?,00000FFF,?), ref: 00B3360A

Strings

Line %d (File "%s"):, xrefs: 00B3366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00B33724
Error: , xrefs: 00B336EF
^ ERROR, xrefs: 00B336C9
"%s" (%d) : ==> %s:, xrefs: 00B33742

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: b1484fd21c7497a6be6e5c094dec661f877fcd4c64e7c26ef3bc3d61f6a42496
Instruction ID: 7280e35ff1ac98c44612fdefe031bcf8694c05aa8678ca766e295aaf693db4f5
Opcode Fuzzy Hash: b1484fd21c7497a6be6e5c094dec661f877fcd4c64e7c26ef3bc3d61f6a42496
Instruction Fuzzy Hash: 7D517F7290020ABADF15EBA0DD46FEEBBB9EF04700F1441A9F105721A1DB301A98DFA5

Function 00B3C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B3C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B3C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B3C2CA
GetLastError.KERNEL32 ref: 00B3C322
SetEvent.KERNEL32(?), ref: 00B3C336
InternetCloseHandle.WININET(00000000), ref: 00B3C341

Strings

, xrefs: 00B3C2BB

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 159ff4d8e7e98ef03b77001b2edd433021115607ec82f79da0ecb9371cac6dc5
Instruction ID: 401c8b29baa1a8147c3b6a4400fd0d11c189c574e11df358ce310eac87ca8278
Opcode Fuzzy Hash: 159ff4d8e7e98ef03b77001b2edd433021115607ec82f79da0ecb9371cac6dc5
Instruction Fuzzy Hash: 70317AB1600308AFD7219FA4CC88AAB7FFDEB49744F24859EF446A3200DB30ED059B65

Function 00B2989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00B03AAF,?,?,Bad directive syntax error,00B5CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00B298BC
LoadStringW.USER32(00000000,?,00B03AAF,?), ref: 00B298C3

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00B29987

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 00B298F1
Error: , xrefs: 00B29955
Line %d:, xrefs: 00B29912
., xrefs: 00B2996D
Line %d (File "%s"):, xrefs: 00B2992D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 835a8d489725ffccfa4b69bab2b9cd574cd934533df7913e2309e0b2f61c43b5
Instruction ID: 8b58eceb82f4c51c7e5b94ae1ec7e6e7c0483ab94017ada8be27931d4e857dbc
Opcode Fuzzy Hash: 835a8d489725ffccfa4b69bab2b9cd574cd934533df7913e2309e0b2f61c43b5
Instruction Fuzzy Hash: BA218D3290031AAFCF15AF90DD0AFEE77B5FF18700F0444AAF519661A2EB319A58DB51

Function 00B2209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00B220AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00B220C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00B2214D

Strings

list, xrefs: 00B2212F
SHELLDLL_DefView, xrefs: 00B220CC
largeicons, xrefs: 00B220E1
smallicons, xrefs: 00B22115
details, xrefs: 00B220FB

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: c87b9273d02d715bdc2bd937c41266c8ad000a510de4ebc280fe31bb4a5416e5
Instruction ID: 088d70b601eb20de7f3a3278e0c3506046871f91254c9df644609b17022132cb
Opcode Fuzzy Hash: c87b9273d02d715bdc2bd937c41266c8ad000a510de4ebc280fe31bb4a5416e5
Instruction Fuzzy Hash: 68110A7A684716B9FA113725FC06DE637DCDF14366B2001A6F708F60F1FE6158219618

Function 00AF8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933c5e54172201337e3da57c3ad2affe7656c59811f2693ab131c73e20373832
Instruction ID: 499e8f954fa1bea4fc34226f052297446ce8b061c1e3e0f66103c2d89c61ce2b
Opcode Fuzzy Hash: 933c5e54172201337e3da57c3ad2affe7656c59811f2693ab131c73e20373832
Instruction Fuzzy Hash: BAC1EE75A0424DAFDB11EFE9D941BBEBFB0AF19310F044099FA15A7292CB358941CB61

Function 00AFCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00AFCEB7
_free.LIBCMT ref: 00AFCF22
_free.LIBCMT ref: 00AFCF48
_free.LIBCMT ref: 00AFCF71
_free.LIBCMT ref: 00AFCFA9
_free.LIBCMT ref: 00AFCFDA
_free.LIBCMT ref: 00AFD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00AFD09C
_free.LIBCMT ref: 00AFD0B5

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 349932335fb9e265bb3e6ff8d3a55c2c17cea5c8cfc31c674e0de407c3681479
Instruction ID: 75b04e9fa9410a071f35daac054605a2cbc945320bb03377198dbfbe8c7542f2
Opcode Fuzzy Hash: 349932335fb9e265bb3e6ff8d3a55c2c17cea5c8cfc31c674e0de407c3681479
Instruction Fuzzy Hash: 7E61177190430DAFDB25AFF99A81B7ABBA5EF05360F04416EFF4597282EB319D018790

Function 00B550D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00B55186
ShowWindow.USER32(?,00000000), ref: 00B551C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00B551CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00B551D1

Part of subcall function 00B56FBA: DeleteObject.GDI32(00000000), ref: 00B56FE6

GetWindowLongW.USER32(?,000000F0), ref: 00B5520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B5521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00B5524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00B55287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00B55296

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 1a1b5b3d32b5fab26a7669b45d8a5d991fa2f167d532450b4475aefe3bfbf80f
Instruction ID: 0393cacaa6f8e0f1339585a29ea70f73cc00b12d7abe65e57394ba34453cc8aa
Opcode Fuzzy Hash: 1a1b5b3d32b5fab26a7669b45d8a5d991fa2f167d532450b4475aefe3bfbf80f
Instruction Fuzzy Hash: E2517130A50A08BEEF309F24CC55B993BE5EB05323F1440D2FE15A66E0C776A988DF41

Function 00AD8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00B16890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00B168A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00B168B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00B168D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00B168F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00AD8874,00000000,00000000,00000000,000000FF,00000000), ref: 00B16901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00B1691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00AD8874,00000000,00000000,00000000,000000FF,00000000), ref: 00B1692D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 376b83849ef3bf4832ee6402f0b4965dcac8aeacf12a6e1f3e804304c9181bf6
Instruction ID: 5cbfd73d4ec5a3c05f8b53e08729e41a0564e24b21555c1c75ffd512c4c486ba
Opcode Fuzzy Hash: 376b83849ef3bf4832ee6402f0b4965dcac8aeacf12a6e1f3e804304c9181bf6
Instruction Fuzzy Hash: 3E518670A00309AFDB20CF28CC95FAA7BB6EB48751F10456AF916972A0DB70E990DB50

Function 00B3C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B3C182
GetLastError.KERNEL32 ref: 00B3C195
SetEvent.KERNEL32(?), ref: 00B3C1A9

Part of subcall function 00B3C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B3C272
Part of subcall function 00B3C253: GetLastError.KERNEL32 ref: 00B3C322
Part of subcall function 00B3C253: SetEvent.KERNEL32(?), ref: 00B3C336
Part of subcall function 00B3C253: InternetCloseHandle.WININET(00000000), ref: 00B3C341

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: e9df2d4119d0bedcad5f24ef7f406801997cc2ffab18c5f42408304bf1ca4647
Instruction ID: 589d04627d37188be2b2e77787b9ab51d422f1013808d1b5894ca29c7ab9effc
Opcode Fuzzy Hash: e9df2d4119d0bedcad5f24ef7f406801997cc2ffab18c5f42408304bf1ca4647
Instruction Fuzzy Hash: F6316971200B05AFDB219FE59C44A67BFE9FF18301F20449DF95AA7610DB31E814EBA0

Function 00B225A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B23A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B23A57
Part of subcall function 00B23A3D: GetCurrentThreadId.KERNEL32 ref: 00B23A5E
Part of subcall function 00B23A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B225B3), ref: 00B23A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00B225BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00B225DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00B225DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00B225E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00B22601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00B22605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00B2260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00B22623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00B22627

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: ec27f3dbb7f0969d0f19ab019f05377f6a5bd07e3cb0dbfcc79265dbb76243d1
Instruction ID: 98d3c31e837f9c404ef7d277e4ada8802d8ae807f99c3afd18353171f7656b94
Opcode Fuzzy Hash: ec27f3dbb7f0969d0f19ab019f05377f6a5bd07e3cb0dbfcc79265dbb76243d1
Instruction Fuzzy Hash: 0301D431390720BBFB1067689C8AF593FDADB4EB12F200052F318AF1D1CDE224448A6A

Function 00B21803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00B21449,?,?,00000000), ref: 00B2180C
HeapAlloc.KERNEL32(00000000,?,00B21449,?,?,00000000), ref: 00B21813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B21449,?,?,00000000), ref: 00B21828
GetCurrentProcess.KERNEL32(?,00000000,?,00B21449,?,?,00000000), ref: 00B21830
DuplicateHandle.KERNEL32(00000000,?,00B21449,?,?,00000000), ref: 00B21833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B21449,?,?,00000000), ref: 00B21843
GetCurrentProcess.KERNEL32(00B21449,00000000,?,00B21449,?,?,00000000), ref: 00B2184B
DuplicateHandle.KERNEL32(00000000,?,00B21449,?,?,00000000), ref: 00B2184E
CreateThread.KERNEL32(00000000,00000000,00B21874,00000000,00000000,00000000), ref: 00B21868

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 3c8a56665727610377d988222116df3723ab22aa6f0b240970c80303b684f1cd
Instruction ID: 53eeec850cc25baf443f367aab2dd7ab0a9d9215ce00fc700589ad335d931153
Opcode Fuzzy Hash: 3c8a56665727610377d988222116df3723ab22aa6f0b240970c80303b684f1cd
Instruction Fuzzy Hash: 0E01BBB5640708BFE710ABB5DC4DF6B3FADEB89B11F104451FA05DB1A1CA749841CB20

Function 00B4A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00B2D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00B2D501
Part of subcall function 00B2D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00B2D50F
Part of subcall function 00B2D4DC: CloseHandle.KERNEL32(00000000), ref: 00B2D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B4A16D
GetLastError.KERNEL32 ref: 00B4A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B4A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00B4A268
GetLastError.KERNEL32(00000000), ref: 00B4A273
CloseHandle.KERNEL32(00000000), ref: 00B4A2C4

Strings

SeDebugPrivilege, xrefs: 00B4A18F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: ecc8d46feddaf4f6016c3e8d78eab64f268a7aa29d93005d116f512b5ee9131a
Instruction ID: 6761d39b5ae5cb31f7ae668ffe34190aecdd1eb413a1cac6974c9903e08a2940
Opcode Fuzzy Hash: ecc8d46feddaf4f6016c3e8d78eab64f268a7aa29d93005d116f512b5ee9131a
Instruction Fuzzy Hash: 4D616B30244242AFD720DF18C494F1ABBE1EF54318F15849CE46A9B7A3C7B2EE45DB92

Function 00B53886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00B53925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00B5393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00B53954
_wcslen.LIBCMT ref: 00B53999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00B539C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00B539F4

Strings

SysListView32, xrefs: 00B538F7

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 2b1a08773249513c8fd61d5ab7db056ccdf23c621d208597de0f307bc8e56fc2
Instruction ID: 1cfcf43dd5a939a237f5f017874de1d95d61edf7936e41c9a6e5212d5d422694
Opcode Fuzzy Hash: 2b1a08773249513c8fd61d5ab7db056ccdf23c621d208597de0f307bc8e56fc2
Instruction Fuzzy Hash: 7941F371A00309ABEF21DF64CC45BEA7BE9EF08791F1005A6F949E7281D7709E84CB90

Function 00B2BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B2BCFD
IsMenu.USER32(00000000), ref: 00B2BD1D
CreatePopupMenu.USER32 ref: 00B2BD53
GetMenuItemCount.USER32(018E5798), ref: 00B2BDA4
InsertMenuItemW.USER32(018E5798,?,00000001,00000030), ref: 00B2BDCC

Strings

0, xrefs: 00B2BCA8
2, xrefs: 00B2BD37

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: ae541400efa0c6fca37f9fb434ef6a884c86b5c05d353c20ae58b038f6916c3a
Instruction ID: f44290db6755f492d3d15779e7d5ad47bf16571b8e6908697b884274d3a1fdc6
Opcode Fuzzy Hash: ae541400efa0c6fca37f9fb434ef6a884c86b5c05d353c20ae58b038f6916c3a
Instruction Fuzzy Hash: 7051EF70A003259BDB10CFA8E8C4FEEBBF4FF44394F1446A9E41997290EB709941CB51

Function 00B2C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00B2C913

Strings

stop, xrefs: 00B2C8E4
question, xrefs: 00B2C8CC
warning, xrefs: 00B2C8FC
info, xrefs: 00B2C8B4
blank, xrefs: 00B2C895

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 0f06bfb79c36a031a80fac0cd7939494dc444236db9dfddd6d3d63bd846e34a2
Instruction ID: bbc24496623aa9e70899f615f383acc07ff6c2cc41c2082715415c72428d88be
Opcode Fuzzy Hash: 0f06bfb79c36a031a80fac0cd7939494dc444236db9dfddd6d3d63bd846e34a2
Instruction Fuzzy Hash: FB113035689316BAE7016754BC83DAE2BDCDF15364B1000BAF504A71D2D7B05D405369

Function 00B2DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00B2DE42
gethostname.WSOCK32(?,00000100), ref: 00B2DE5C
gethostbyname.WSOCK32(?), ref: 00B2DE69
inet_ntoa.WSOCK32(?), ref: 00B2DEAB
_strcat.LIBCMT ref: 00B2DEB9
WSACleanup.WSOCK32 ref: 00B2DEDE

Strings

0.0.0.0, xrefs: 00B2DE87

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 5694f0cd847c288351b09172572ef2052fcf37a2ef9f38bad70051906edd3ed9
Instruction ID: a8c6058aa3b0e0fa2c7ad1d26e88acd9115b8fd6eda5fa2688b6b92fffffbcd5
Opcode Fuzzy Hash: 5694f0cd847c288351b09172572ef2052fcf37a2ef9f38bad70051906edd3ed9
Instruction Fuzzy Hash: 0A110A71504314AFDF20BB61AC4AEEE77ECDF14711F0101E9F449A7091EF748A818A60

Function 00B59F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AD9BB2

GetSystemMetrics.USER32(0000000F), ref: 00B59FC7
GetSystemMetrics.USER32(0000000F), ref: 00B59FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00B5A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00B5A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00B5A263
ShowWindow.USER32(00000003,00000000), ref: 00B5A282
InvalidateRect.USER32(?,00000000,00000001), ref: 00B5A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 00B5A2CA

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: be3d496ef35503b58842a11d21f58ac3ed9751ebc5e20926ed2d621f80f73455
Instruction ID: d66618c1c756f733c53e0f1af5aad548a82d4d65855f4ee76b6c736d4011d101
Opcode Fuzzy Hash: be3d496ef35503b58842a11d21f58ac3ed9751ebc5e20926ed2d621f80f73455
Instruction Fuzzy Hash: 38B17931600219DFDF14CF68C9867AA7BF2FF49702F0881E9ED45AB295DB32A944CB51

Function 00B2ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00B2ED2A
_wcslen.LIBCMT ref: 00B2ED3B
_wcslen.LIBCMT ref: 00B2ED79
_wcslen.LIBCMT ref: 00B2EDAF
_wcslen.LIBCMT ref: 00B2EDDF
_wcslen.LIBCMT ref: 00B2EDEF
_wcslen.LIBCMT ref: 00B2EE2B
_wcslen.LIBCMT ref: 00B2EE5A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 52efb0c678e8d780c047e343d22c1092c6e750d5a8aecb23ccd5a999bda9e196
Instruction ID: eb0ef10f5555fcf92eaa880b173bd3979e600a1bd0ce8dd425b1d13703714059
Opcode Fuzzy Hash: 52efb0c678e8d780c047e343d22c1092c6e750d5a8aecb23ccd5a999bda9e196
Instruction Fuzzy Hash: 36419665C1025875DB11EBF6888A9CF77ACAF45710F5048A2E628F3122FB34D255C3E5

Function 00ADF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00B1682C,00000004,00000000,00000000), ref: 00ADF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00B1682C,00000004,00000000,00000000), ref: 00B1F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00B1682C,00000004,00000000,00000000), ref: 00B1F454

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: d8990370376627939751e17d30cc9f5f9a5f28739caef33b492b410bb534e8e7
Instruction ID: 026f1a05acfb6d83eeaa8fa139482c03104f8c3dad11b5acde4598cf003bbef7
Opcode Fuzzy Hash: d8990370376627939751e17d30cc9f5f9a5f28739caef33b492b410bb534e8e7
Instruction Fuzzy Hash: F2412931A08780BEC7398B2D9DA87BB7BE2AB56310F54447EE06B57760CA31A8C0C711

Function 00B52D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B52D1B
GetDC.USER32(00000000), ref: 00B52D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B52D2E
ReleaseDC.USER32(00000000,00000000), ref: 00B52D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00B52D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00B52D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00B55A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00B52DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00B52DE1

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 291851aff81f66a03a0cb27034947f91b4de3362fb7d5dcb15604c9281748630
Instruction ID: b0acc1fb785e7263a7161d120dc704f7124b25b54a2f61514dac9ba6edbad95d
Opcode Fuzzy Hash: 291851aff81f66a03a0cb27034947f91b4de3362fb7d5dcb15604c9281748630
Instruction Fuzzy Hash: 82316F72201314BFEB114F508C49FEB3FA9EB09716F0440A5FE089B291CA759C50CB64

Function 00B25622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00B25637
_memcmp.LIBVCRUNTIME ref: 00B25659
_memcmp.LIBVCRUNTIME ref: 00B25671
_memcmp.LIBVCRUNTIME ref: 00B25684
_memcmp.LIBVCRUNTIME ref: 00B2569E
_memcmp.LIBVCRUNTIME ref: 00B256B1
_memcmp.LIBVCRUNTIME ref: 00B256C9
_memcmp.LIBVCRUNTIME ref: 00B256E4

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 262e8ce30648043f90c042195c4c3ff3dda2c84ae0c37f49e01395f9c66e979f
Instruction ID: ebdf2d3376408d3bc6f3bb1137ea8f02f22d74e5780dbfd3441d8a40f2787f69
Opcode Fuzzy Hash: 262e8ce30648043f90c042195c4c3ff3dda2c84ae0c37f49e01395f9c66e979f
Instruction Fuzzy Hash: F321C571A41A6A77D6359921AE82FBB73DCEE21385F4400B0FD089A591F770ED1481A5

Function 00B44FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00B4502E, 00B45383
Not an Object type, xrefs: 00B45007

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 65791efccdcb438f17ff0e07d730c2c1add4813af9afccef0aec6eb34889fd90
Instruction ID: 3d38e1dd10be3081e85c055186fd1753e1bcf62c5b9996ec20feaadae2284631
Opcode Fuzzy Hash: 65791efccdcb438f17ff0e07d730c2c1add4813af9afccef0aec6eb34889fd90
Instruction Fuzzy Hash: 3AD1A375A00A0A9FDF20CF98C881BAEB7F5FF48344F1484A9E915AB292D770DE45DB50

Function 00B01522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00B015CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00B01651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B016E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00B016FB

Part of subcall function 00AF3820: RtlAllocateHeap.NTDLL(00000000,?,00B91444,?,00ADFDF5,?,?,00ACA976,00000010,00B91440,00AC13FC,?,00AC13C6,?,00AC1129), ref: 00AF3852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B01777
__freea.LIBCMT ref: 00B017A2
__freea.LIBCMT ref: 00B017AE

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: c4efef76d23c6d38d7f16ced197087e204cbda32daad8963bbd07e1a3e28e45c
Instruction ID: 2525b95477cb999e5da2734f06827f874bcf784834fa8b71788e3f25fbe1aae1
Opcode Fuzzy Hash: c4efef76d23c6d38d7f16ced197087e204cbda32daad8963bbd07e1a3e28e45c
Instruction Fuzzy Hash: 7F918271E002169EDB288EA8CD81AEE7FF5EF59750F184A99E901EB1C1DB35DD40CB60

Function 00B44523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B44648
VariantInit.OLEAUT32(?), ref: 00B44749
VariantClear.OLEAUT32(?), ref: 00B44753
VariantClear.OLEAUT32(?), ref: 00B447B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00B4472C
Null Object assignment in FOR..IN loop, xrefs: 00B445D8, 00B44706, 00B447BE

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 61be821dc466ded6ff0270cf8a96694208179c2320a5e30120f13c501fede909
Instruction ID: b41c3b1d05036ba80c9100d2274c3a07d87dda929dea877ea5b3ec3027aaa3d3
Opcode Fuzzy Hash: 61be821dc466ded6ff0270cf8a96694208179c2320a5e30120f13c501fede909
Instruction Fuzzy Hash: 81917F71A00215ABDF20DFA4C884FAEBBF8EF46714F108599F515AB280D7709E55DBA0

Function 00B31187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00B3125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00B31284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00B312A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B312D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B3135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B313C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B31430

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 43263683fa280fc7515baf403b8b559782d41ff13b780b1db073152aca91fa73
Instruction ID: 1a33fbcc02a2fe4ed89102cffbd129fe8e51809399281d41de24646f640442bf
Opcode Fuzzy Hash: 43263683fa280fc7515baf403b8b559782d41ff13b780b1db073152aca91fa73
Instruction Fuzzy Hash: 0A91E371A00208AFDB00DF98C895BBE77F9FF44715F2048A9E541E7391DB74A945CB90

Function 00AD948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8daf1c897978f27e49c1927cba682bd33f4f80257c15c69519fff3eb653c417c
Instruction ID: 1365c2dbce0b5546b3eb4b322ac3cc2b972ad4d8319631fb1293358008d5deaa
Opcode Fuzzy Hash: 8daf1c897978f27e49c1927cba682bd33f4f80257c15c69519fff3eb653c417c
Instruction Fuzzy Hash: 0F914971D40219EFCB10CFA9DC84AEEBBB9FF49320F148196E516B7251D774AA42CB60

Function 00B43947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B4396B
CharUpperBuffW.USER32(?,?), ref: 00B43A7A
_wcslen.LIBCMT ref: 00B43A8A
VariantClear.OLEAUT32(?), ref: 00B43C1F

Part of subcall function 00B30CDF: VariantInit.OLEAUT32(00000000), ref: 00B30D1F
Part of subcall function 00B30CDF: VariantCopy.OLEAUT32(?,?), ref: 00B30D28
Part of subcall function 00B30CDF: VariantClear.OLEAUT32(?), ref: 00B30D34

Strings

Incorrect Parameter format, xrefs: 00B439A6, 00B43BA1
AUTOIT.ERROR, xrefs: 00B43A80, 00B43A85

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 6bd6b56b634b03119c3ca9e66804642ab9868ea790cf0d0d9c3162a943e07f76
Instruction ID: f5a170a04b5c75ea34dd4779ccbeab992378d725c0bc8acbb34d16b0eb29ec00
Opcode Fuzzy Hash: 6bd6b56b634b03119c3ca9e66804642ab9868ea790cf0d0d9c3162a943e07f76
Instruction Fuzzy Hash: 6B9169756083059FC700EF24C581A6AB7E5FF88714F1888ADF88A9B351DB30EE45DB92

Function 00B44BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00B2000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B1FF41,80070057,?,?,?,00B2035E), ref: 00B2002B
Part of subcall function 00B2000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B1FF41,80070057,?,?), ref: 00B20046
Part of subcall function 00B2000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B1FF41,80070057,?,?), ref: 00B20054
Part of subcall function 00B2000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B1FF41,80070057,?), ref: 00B20064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00B44C51
_wcslen.LIBCMT ref: 00B44D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00B44DCF
CoTaskMemFree.OLE32(?), ref: 00B44DDA

Strings

NULL Pointer assignment, xrefs: 00B44E23, 00B44E52

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: ecac53b5eea28ebce3bae2f8e67f1ba30296f815ce4cd164513f6178eaa407f5
Instruction ID: 61d7efb869b6bec397dc19f2402ad814865a4d46bb816386108ddbce9e9606be
Opcode Fuzzy Hash: ecac53b5eea28ebce3bae2f8e67f1ba30296f815ce4cd164513f6178eaa407f5
Instruction Fuzzy Hash: B4911471D0021DAFDF14DFA4D891EEEBBB9FF08304F1085A9E919A7251DB309A549FA0

Function 00B520FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00B52183
GetMenuItemCount.USER32(00000000), ref: 00B521B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00B521DD
_wcslen.LIBCMT ref: 00B52213
GetMenuItemID.USER32(?,?), ref: 00B5224D
GetSubMenu.USER32(?,?), ref: 00B5225B

Part of subcall function 00B23A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B23A57
Part of subcall function 00B23A3D: GetCurrentThreadId.KERNEL32 ref: 00B23A5E
Part of subcall function 00B23A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B225B3), ref: 00B23A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00B522E3

Part of subcall function 00B2E97B: Sleep.KERNELBASE ref: 00B2E9F3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: fda78f5640d10cf5e734a535334efa8e6e689a94469b9edac7d841f08217d361
Instruction ID: c6c14ff9a597334659b542b388788c021d14a02db2895742a1db2073b6e84a0f
Opcode Fuzzy Hash: fda78f5640d10cf5e734a535334efa8e6e689a94469b9edac7d841f08217d361
Instruction Fuzzy Hash: 7D717B75A00205AFCB10DFA4C881BAEBBF5EF49321F1584D9E916BB341DB35AE458F90

Function 00B57E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(018E5770), ref: 00B57F37
IsWindowEnabled.USER32(018E5770), ref: 00B57F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00B5801E
SendMessageW.USER32(018E5770,000000B0,?,?), ref: 00B58051
IsDlgButtonChecked.USER32(?,?), ref: 00B58089
GetWindowLongW.USER32(018E5770,000000EC), ref: 00B580AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00B580C3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 8a7fc3ffbe2d0c373b1e9f71b49fbe3fedccd02fb5a5b465362d01d46ae615fc
Instruction ID: 9e40f0c072888eb43f0ed6ed5dbd119266d4a915f1c6c1f1ac81a97d8b496c9d
Opcode Fuzzy Hash: 8a7fc3ffbe2d0c373b1e9f71b49fbe3fedccd02fb5a5b465362d01d46ae615fc
Instruction Fuzzy Hash: 79719C34648384AFEB21DF64D884FAABBF5EF09302F1444D9ED45A72A1CF31A949DB50

Function 00B2AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00B2AEF9
GetKeyboardState.USER32(?), ref: 00B2AF0E
SetKeyboardState.USER32(?), ref: 00B2AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00B2AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00B2AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00B2AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00B2B020

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 5f173c8fbbdcc436624e7f849451c28be09795ac41abd7d1a1eca0e222ffd019
Instruction ID: 6938b41e0ae4f5f1f4aec042dcaae99f012fc9208250da512c0801e4de8ca8f7
Opcode Fuzzy Hash: 5f173c8fbbdcc436624e7f849451c28be09795ac41abd7d1a1eca0e222ffd019
Instruction Fuzzy Hash: AD51C0A06047E53EFB3742349945BBBBFE99B06304F0884C9E1ED968C2D798AC85D751

Function 00B2ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00B2AD19
GetKeyboardState.USER32(?), ref: 00B2AD2E
SetKeyboardState.USER32(?), ref: 00B2AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00B2ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00B2ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00B2AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00B2AE38

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: a26d0d831e93e2b8bdcfcf2ebfe6815b455b400a67e4e4032cb0d40eee96ebd0
Instruction ID: e1d9c2779a4485cba250428c67994e7ed2f812af19322d580227050807461ee2
Opcode Fuzzy Hash: a26d0d831e93e2b8bdcfcf2ebfe6815b455b400a67e4e4032cb0d40eee96ebd0
Instruction Fuzzy Hash: 8A5115A05047E53EFB3393349C85BBABEE99B06300F0884C8E1DD568C3D694EC89D752

Function 00AF542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00B03CD6,?,?,?,?,?,?,?,?,00AF5BA3,?,?,00B03CD6,?,?), ref: 00AF5470
__fassign.LIBCMT ref: 00AF54EB
__fassign.LIBCMT ref: 00AF5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00B03CD6,00000005,00000000,00000000), ref: 00AF552C
WriteFile.KERNEL32(?,00B03CD6,00000000,00AF5BA3,00000000,?,?,?,?,?,?,?,?,?,00AF5BA3,?), ref: 00AF554B
WriteFile.KERNEL32(?,?,00000001,00AF5BA3,00000000,?,?,?,?,?,?,?,?,?,00AF5BA3,?), ref: 00AF5584

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 3bc095717e66bfbdc0fc2a2eb228ce91b3ea51be2f4be2c51fc0c0e542de1507
Instruction ID: 524c64f235314d7d2034ae06befe8e19b8f31e46c321b94a198dbd3c5bc3e89e
Opcode Fuzzy Hash: 3bc095717e66bfbdc0fc2a2eb228ce91b3ea51be2f4be2c51fc0c0e542de1507
Instruction Fuzzy Hash: E5517D71E006499FDB11CFF8D885AEEBBF9EF09300F14415AF655E7291D6309A41CB60

Function 00AE2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00AE2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00AE2D53
_ValidateLocalCookies.LIBCMT ref: 00AE2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00AE2E0C
_ValidateLocalCookies.LIBCMT ref: 00AE2E61

Strings

csm, xrefs: 00AE2DF6

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3a6b157402e524aaf51bb679fb2521513d8a113b4a498a6aec334221f65f0505
Instruction ID: 14b6eb8fc590038a00f585f7f2419120609216a49cfe0f4a4aeac27bbdd7079b
Opcode Fuzzy Hash: 3a6b157402e524aaf51bb679fb2521513d8a113b4a498a6aec334221f65f0505
Instruction Fuzzy Hash: 4F41B535E012499BCF10DF6ACC85BAEBBB9BF44314F148155E9146B392D7719A01CB90

Function 00B410B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00B4307A
Part of subcall function 00B4304E: _wcslen.LIBCMT ref: 00B4309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00B41112
WSAGetLastError.WSOCK32 ref: 00B41121
WSAGetLastError.WSOCK32 ref: 00B411C9
closesocket.WSOCK32(00000000), ref: 00B411F9

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: e7f6e8c8bb0189461abf0303b6d17407ee94d05df945f3fde6f02820f6e108c9
Instruction ID: 722d4c7acedc5c876ea18f2f23a1bfd28b68d7db636124e1e896f462dd3c194a
Opcode Fuzzy Hash: e7f6e8c8bb0189461abf0303b6d17407ee94d05df945f3fde6f02820f6e108c9
Instruction Fuzzy Hash: 3741E931600314AFDB10DF18C885BA9BBEAEF45365F148499FD15AB291D770EE81CBE1

Function 00B2CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B2CF22,?), ref: 00B2DDFD

Part of subcall function 00B2DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B2CF22,?), ref: 00B2DE16

lstrcmpiW.KERNEL32(?,?), ref: 00B2CF45
MoveFileW.KERNEL32(?,?), ref: 00B2CF7F
_wcslen.LIBCMT ref: 00B2D005
_wcslen.LIBCMT ref: 00B2D01B
SHFileOperationW.SHELL32(?), ref: 00B2D061

Strings

\*.*, xrefs: 00B2CFF3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 435704b1498b1c283d50182e73f842653957581cb23b81183dced701f517d729
Instruction ID: 9caa942bee00b08987ceca1312e63cb7b7fc7edbf07bb0d384fe864cb5e67e91
Opcode Fuzzy Hash: 435704b1498b1c283d50182e73f842653957581cb23b81183dced701f517d729
Instruction Fuzzy Hash: 3A4157719452285EDF12EFA4DA81ADE77F9EF08380F1000E6E54DEB141EA34A648CB50

Function 00B52DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B52E1C
GetWindowLongW.USER32(?,000000F0), ref: 00B52E4F
GetWindowLongW.USER32(?,000000F0), ref: 00B52E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B52EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B52EE0
GetWindowLongW.USER32(?,000000F0), ref: 00B52EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B52F0B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: c6b53a150bda8dfb431ae449fcb0ad7375e2702fec5061021a7e8a5deae0fc9c
Instruction ID: cb4aff388c8f19bed2a780b616e554fcff29b36c8dd7ab28f72275ced5a282ab
Opcode Fuzzy Hash: c6b53a150bda8dfb431ae449fcb0ad7375e2702fec5061021a7e8a5deae0fc9c
Instruction Fuzzy Hash: 74310230606251AFEB21CF58ED86F653BE1EB9A712F1501E5F9008F2B2CB71A849DB41

Function 00B27726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B27769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B2778F
SysAllocString.OLEAUT32(00000000), ref: 00B27792
SysAllocString.OLEAUT32(?), ref: 00B277B0
SysFreeString.OLEAUT32(?), ref: 00B277B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00B277DE
SysAllocString.OLEAUT32(?), ref: 00B277EC

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 7b4989a6f3457dde7287f8fb832a75339acd96c6f086ce901c0f1ddba47ce519
Instruction ID: 50f16c6515bdd98002c085010c6a205b244139d6605145571dea8252a93bd307
Opcode Fuzzy Hash: 7b4989a6f3457dde7287f8fb832a75339acd96c6f086ce901c0f1ddba47ce519
Instruction Fuzzy Hash: EE21B276604329AFDF10DFA8DC88DBB77EDEB0936470080A5F909DB260DA70DC4187A4

Function 00B277FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B27842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B27868
SysAllocString.OLEAUT32(00000000), ref: 00B2786B
SysAllocString.OLEAUT32 ref: 00B2788C
SysFreeString.OLEAUT32 ref: 00B27895
StringFromGUID2.OLE32(?,?,00000028), ref: 00B278AF
SysAllocString.OLEAUT32(?), ref: 00B278BD

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 9966e4b42d15def9fd367cfc62c1575f3a704f73a262524db036efe9f8a4bc40
Instruction ID: 86eef68597c55d85531a33d15385a86af623e70bf187dd64623b5c38a0c5b34e
Opcode Fuzzy Hash: 9966e4b42d15def9fd367cfc62c1575f3a704f73a262524db036efe9f8a4bc40
Instruction Fuzzy Hash: 99217435604224AFDB109FA9DC8CDBA77ECEB097607108165F919CB2A5DE74DC41CB68

Function 00B304D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00B304F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B3052E

Strings

nul, xrefs: 00B30567

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 71fd2b5b0bdfb126656b0a332bb695b72a469981b8ed4f007d9cac6c410ee529
Instruction ID: de9bb479580bc773afa35a349845d1ca50b1695fd22f60f003d0dd6624cd32c8
Opcode Fuzzy Hash: 71fd2b5b0bdfb126656b0a332bb695b72a469981b8ed4f007d9cac6c410ee529
Instruction Fuzzy Hash: 08215A75510305AFDB20AF29D894A9A7BF4EF64724F314A99E8A1E72E0DB709941CF20

Function 00B305A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00B305C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B30601

Strings

nul, xrefs: 00B30639

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: cee71a03284e0845f97bb6f2b193d6a0c565e9cd58f837fe49b355a6c6ba02df
Instruction ID: cbd2f4ea542535116910949bcd39315d3a3fc0966eddbf05a15b27ddff30017f
Opcode Fuzzy Hash: cee71a03284e0845f97bb6f2b193d6a0c565e9cd58f837fe49b355a6c6ba02df
Instruction Fuzzy Hash: 4C21B235510305AFDB20AF69CC55A9A77E8FF95B20F300A99F8A1E72E4DB709861CB10

Function 00B540AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00AC604C
Part of subcall function 00AC600E: GetStockObject.GDI32(00000011), ref: 00AC6060
Part of subcall function 00AC600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AC606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00B54112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00B5411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00B5412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00B54139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00B54145

Strings

Msctls_Progress32, xrefs: 00B540E3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 393da408327ebbda37a48c6120a5dd0ef44fd1cbadfad1016b20183cd09afb08
Instruction ID: 07a8d823ef147913c616ab395f29e7954ed72b46b500224a75aa212febe79a40
Opcode Fuzzy Hash: 393da408327ebbda37a48c6120a5dd0ef44fd1cbadfad1016b20183cd09afb08
Instruction Fuzzy Hash: 4F11B2B2140219BEEF119F64CC85EE77F9DEF08798F114151BA18A60A0CB72DC61DBA4

Function 00AFD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AFD7A3: _free.LIBCMT ref: 00AFD7CC

_free.LIBCMT ref: 00AFD82D

Part of subcall function 00AF29C8: HeapFree.KERNEL32(00000000,00000000,?,00AFD7D1,00000000,00000000,00000000,00000000,?,00AFD7F8,00000000,00000007,00000000,?,00AFDBF5,00000000), ref: 00AF29DE
Part of subcall function 00AF29C8: GetLastError.KERNEL32(00000000,?,00AFD7D1,00000000,00000000,00000000,00000000,?,00AFD7F8,00000000,00000007,00000000,?,00AFDBF5,00000000,00000000), ref: 00AF29F0

_free.LIBCMT ref: 00AFD838
_free.LIBCMT ref: 00AFD843
_free.LIBCMT ref: 00AFD897
_free.LIBCMT ref: 00AFD8A2
_free.LIBCMT ref: 00AFD8AD
_free.LIBCMT ref: 00AFD8B8

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: d0fc9a9a800b8e62476c7900d339d3a9d9ec53dab411f66124bd3e2f3a4f0ddc
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 8A112E71580B0CAAD622BFF0CE47FEB7BDDAF44700F404825B399AE4A2DA75B5058760

Function 00B2DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00B2DA74
LoadStringW.USER32(00000000), ref: 00B2DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00B2DA91
LoadStringW.USER32(00000000), ref: 00B2DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B2DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00B2DAB9

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: c9404d894d96b6b53e8c85a27a99310552354937969ee042f1d0ca0428b506d3
Instruction ID: ca4daa490520ee7959c426bcdb79971862e69c5b67d619240fe3f23e26fea88d
Opcode Fuzzy Hash: c9404d894d96b6b53e8c85a27a99310552354937969ee042f1d0ca0428b506d3
Instruction Fuzzy Hash: 0E014FF25003187FE751ABA09D89FEA36ACE708706F4044D5B70AE3041EA749E848F74

Function 00B3096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(018DE950,018DE950), ref: 00B3097B
EnterCriticalSection.KERNEL32(018DE930,00000000), ref: 00B3098D
TerminateThread.KERNEL32(?,000001F6), ref: 00B3099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00B309A9
CloseHandle.KERNEL32(?), ref: 00B309B8
InterlockedExchange.KERNEL32(018DE950,000001F6), ref: 00B309C8
LeaveCriticalSection.KERNEL32(018DE930), ref: 00B309CF

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 1a99f807aa0e93c967cb2b4588ad062af7369e43c0e25ceec7505a4134962442
Instruction ID: 2202dcb8c41dccf0e748bc08d8702972687d44980a4629c72b2194348acacc5c
Opcode Fuzzy Hash: 1a99f807aa0e93c967cb2b4588ad062af7369e43c0e25ceec7505a4134962442
Instruction Fuzzy Hash: 0AF01D31442B02AFD7415B94EE88BDA7A66FF01702F501155F102518A0CB759465CF90

Function 00AC5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00AC5D30
GetWindowRect.USER32(?,?), ref: 00AC5D71
ScreenToClient.USER32(?,?), ref: 00AC5D99
GetClientRect.USER32(?,?), ref: 00AC5ED7
GetWindowRect.USER32(?,?), ref: 00AC5EF8

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: ff90e0db1cee9abd4291bea903ac2baacf018cae167f6b23289a16b60733f35b
Instruction ID: 4bf797087621493923563af9382de30a94e1d2d8f1f8464f024430eb8fbc5dfd
Opcode Fuzzy Hash: ff90e0db1cee9abd4291bea903ac2baacf018cae167f6b23289a16b60733f35b
Instruction Fuzzy Hash: F3B14974A0074ADBDB14CFB9C480BEABBF1FF54310F14841AE9A9D7290DB30AA91DB54

Function 00AF01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00AF00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AF00D6
__allrem.LIBCMT ref: 00AF00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AF010B
__allrem.LIBCMT ref: 00AF0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AF0140

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 83089e9bfd09a851e506dea2cf4b97c06d14b1b502ee811d0bffc584453eede8
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: E881E672A00B0A9FE724AFA9CC41F7A73F9EF41764F24463AF651D6682EB70D9008754

Function 00B41D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B43149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00B4101C,00000000,?,?,00000000), ref: 00B43195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00B41DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00B41DE1
WSAGetLastError.WSOCK32 ref: 00B41DF2
inet_ntoa.WSOCK32(?), ref: 00B41E8C
htons.WSOCK32(?,?,?,?,?), ref: 00B41EDB
_strlen.LIBCMT ref: 00B41F35

Part of subcall function 00B239E8: _strlen.LIBCMT ref: 00B239F2

Part of subcall function 00AC6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00ADCF58,?,?,?), ref: 00AC6DBA
Part of subcall function 00AC6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00ADCF58,?,?,?), ref: 00AC6DED

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 5a35f028bdb43e6ebaacffd7692f9563e292f66cda76bca8693e117d64b7eaea
Instruction ID: ef118431e252848ad19a3d5a7db2f3644598e44bcf6eb0db097bb481047a7ac7
Opcode Fuzzy Hash: 5a35f028bdb43e6ebaacffd7692f9563e292f66cda76bca8693e117d64b7eaea
Instruction Fuzzy Hash: 64A1D371904340AFC324DF28C895F2A7BE5EF84318F54899CF4565B2A2DB31EE86CB91

Function 00AF61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00AE82D9,00AE82D9,?,?,?,00AF644F,00000001,00000001,8BE85006), ref: 00AF6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00AF644F,00000001,00000001,8BE85006,?,?,?), ref: 00AF62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00AF63D8
__freea.LIBCMT ref: 00AF63E5

Part of subcall function 00AF3820: RtlAllocateHeap.NTDLL(00000000,?,00B91444,?,00ADFDF5,?,?,00ACA976,00000010,00B91440,00AC13FC,?,00AC13C6,?,00AC1129), ref: 00AF3852

__freea.LIBCMT ref: 00AF63EE
__freea.LIBCMT ref: 00AF6413

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 7a61a4dabf42cf00f93cc9c1287e27f2a7d311070c4ab81aa8c8dc3b5b2688cb
Instruction ID: d724442c78f9b65d4269220026913c94ed805500bdf7fa646e781402f1cee12c
Opcode Fuzzy Hash: 7a61a4dabf42cf00f93cc9c1287e27f2a7d311070c4ab81aa8c8dc3b5b2688cb
Instruction Fuzzy Hash: 7851C272A0021AABDF258FA4CD81EBFBBAAEB55750F154729FE05DB140DB34DC44C6A0

Function 00B4BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

Part of subcall function 00B4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B4B6AE,?,?), ref: 00B4C9B5
Part of subcall function 00B4C998: _wcslen.LIBCMT ref: 00B4C9F1
Part of subcall function 00B4C998: _wcslen.LIBCMT ref: 00B4CA68
Part of subcall function 00B4C998: _wcslen.LIBCMT ref: 00B4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B4BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B4BD25
RegCloseKey.ADVAPI32(00000000), ref: 00B4BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00B4BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B4BDF3
RegCloseKey.ADVAPI32(?), ref: 00B4BDFF

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: d40f4de82e4665c6b13190b226a9ad50071698ac58833d49931e3f9001483858
Instruction ID: c3941c0f79b22a5f97472f42b38356af6dfbef40a8a25df4ffad3297cdf98d7f
Opcode Fuzzy Hash: d40f4de82e4665c6b13190b226a9ad50071698ac58833d49931e3f9001483858
Instruction Fuzzy Hash: E6817E30508341AFD714DF24C995E2ABBE5FF84308F1489ACF55A4B2A2DB31EE45DB92

Function 00B1F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00B1F7B9
SysAllocString.OLEAUT32(00000001), ref: 00B1F860
VariantCopy.OLEAUT32(00B1FA64,00000000), ref: 00B1F889
VariantClear.OLEAUT32(00B1FA64), ref: 00B1F8AD
VariantCopy.OLEAUT32(00B1FA64,00000000), ref: 00B1F8B1
VariantClear.OLEAUT32(?), ref: 00B1F8BB

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 51b3c569afae7dfbb129ba8cb9907b17c4979dc1f2f94a3d6eb4d21feacbb368
Instruction ID: c88c39aeac2192f4db5b0aa171fab507b786a25b665d9a93af06f91fb87cb631
Opcode Fuzzy Hash: 51b3c569afae7dfbb129ba8cb9907b17c4979dc1f2f94a3d6eb4d21feacbb368
Instruction Fuzzy Hash: 0351B531500312FACF10AB65D895BB9B3E5EF45710F6484E7E806DF291DB708C80CBA6

Function 00B3910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00AC7620: _wcslen.LIBCMT ref: 00AC7625

Part of subcall function 00AC6B57: _wcslen.LIBCMT ref: 00AC6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00B394E5
_wcslen.LIBCMT ref: 00B39506
_wcslen.LIBCMT ref: 00B3952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00B39585

Strings

X, xrefs: 00B39412

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 53c4a6ceed71bca7dc2ce0fa0f8c10655c6402f696e2a4d2f9595ee8e98e8d81
Instruction ID: dc0a94c86767595b4a94ca8ba5c4b266ca461ddfa2cda06f378e6a1208d9c54e
Opcode Fuzzy Hash: 53c4a6ceed71bca7dc2ce0fa0f8c10655c6402f696e2a4d2f9595ee8e98e8d81
Instruction Fuzzy Hash: E7E18D315083408FD724DF24C981B6AB7E0FF84314F1589ADE89A9B3A2DB71DD45CB92

Function 00AD920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00AD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AD9BB2

BeginPaint.USER32(?,?,?), ref: 00AD9241
GetWindowRect.USER32(?,?), ref: 00AD92A5
ScreenToClient.USER32(?,?), ref: 00AD92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00AD92D3
EndPaint.USER32(?,?,?,?,?), ref: 00AD9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00B171EA

Part of subcall function 00AD9339: BeginPath.GDI32(00000000), ref: 00AD9357

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: f2d931d0162af6fdd299158f056e229da81807d6d1fceac61707e1386c356c67
Instruction ID: e44f19145fe0947adf48a8dddd44b2518f06359fa50365e3ac72dd10fa1256b1
Opcode Fuzzy Hash: f2d931d0162af6fdd299158f056e229da81807d6d1fceac61707e1386c356c67
Instruction Fuzzy Hash: 2741AD70104301AFD711DF28DC84FAB7BF9EF45721F1406AAF9A69B2A1CB319845DB61

Function 00B307EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00B3080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00B30847
EnterCriticalSection.KERNEL32(?), ref: 00B30863
LeaveCriticalSection.KERNEL32(?), ref: 00B308DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00B308F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00B30921

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 4a930724a3badfdb8d0107b588e6ab2b2b6101de22086bd7322f3f43f22ad21b
Instruction ID: 4d46bbf4632e565a073387b42cbc24b8109673f64871bc5d64e45f9b5db97453
Opcode Fuzzy Hash: 4a930724a3badfdb8d0107b588e6ab2b2b6101de22086bd7322f3f43f22ad21b
Instruction Fuzzy Hash: 97417A71900205EFDF14AF54DC85A6ABBB9FF04300F1440A5ED05AB297DB31DE65DBA0

Function 00B581DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00B1F3AB,00000000,?,?,00000000,?,00B1682C,00000004,00000000,00000000), ref: 00B5824C
EnableWindow.USER32(?,00000000), ref: 00B58272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00B582D1
ShowWindow.USER32(?,00000004), ref: 00B582E5
EnableWindow.USER32(?,00000001), ref: 00B5830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00B5832F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 1478608d2156090eeb7546ec37d85635d60ec78da7bdb617cf0eb5565f659990
Instruction ID: 2ff418e14c8492d695dfaa59684af6cea1db550727da9ce00bf86841f379d296
Opcode Fuzzy Hash: 1478608d2156090eeb7546ec37d85635d60ec78da7bdb617cf0eb5565f659990
Instruction Fuzzy Hash: BD41B430601745AFDF12CF15C999BE47FE1FB4A716F1841E9E9089B262CB72A84ACF50

Function 00B24C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B24C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00B24CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00B24CEA
_wcslen.LIBCMT ref: 00B24D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00B24D10
_wcsstr.LIBVCRUNTIME ref: 00B24D1A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 8ec04511369a9ef4cdf778ecc6982c7e5b9f74932fb0ace40cdce176cbc6644c
Instruction ID: c75b1df3ba497e18b30425b09f0027f09ac74d33266adb633ad1b0ab66955b2a
Opcode Fuzzy Hash: 8ec04511369a9ef4cdf778ecc6982c7e5b9f74932fb0ace40cdce176cbc6644c
Instruction Fuzzy Hash: 6121C232204220BFEB155B29AD49A7B7FDDDF45750F1080BAF80ACB192EF61DD0096A0

Function 00B3581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AC3A97,?,?,00AC2E7F,?,?,?,00000000), ref: 00AC3AC2

_wcslen.LIBCMT ref: 00B3587B
CoInitialize.OLE32(00000000), ref: 00B35995
CoCreateInstance.OLE32(00B5FCF8,00000000,00000001,00B5FB68,?), ref: 00B359AE
CoUninitialize.OLE32 ref: 00B359CC

Strings

.lnk, xrefs: 00B35876, 00B358C1, 00B35985

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: dcef145e9087d6d1a807c0cfad632f4b6ef662d5391fd293d27e630a483056ee
Instruction ID: ad86979d127623c5584fbad14bdf8f33152dcd1edc5f8bd1adf7fb604b5efaf2
Opcode Fuzzy Hash: dcef145e9087d6d1a807c0cfad632f4b6ef662d5391fd293d27e630a483056ee
Instruction Fuzzy Hash: D7D172746087019FC724DF24C580A2ABBE5EF89710F21899DF88A9B361DB31EC05CB92

Function 00B2175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B20FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B20FCA
Part of subcall function 00B20FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B20FD6
Part of subcall function 00B20FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B20FE5
Part of subcall function 00B20FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B20FEC
Part of subcall function 00B20FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B21002

GetLengthSid.ADVAPI32(?,00000000,00B21335), ref: 00B217AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00B217BA
HeapAlloc.KERNEL32(00000000), ref: 00B217C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00B217DA
GetProcessHeap.KERNEL32(00000000,00000000,00B21335), ref: 00B217EE
HeapFree.KERNEL32(00000000), ref: 00B217F5

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 9817062cb5890b0886604234557cd7ef8a5b3d0808c67c2c6ca921322d514e00
Instruction ID: 8b4a239956808f1b55a51e7897e5816a37a0a05a04729c66c4f1a467853faba9
Opcode Fuzzy Hash: 9817062cb5890b0886604234557cd7ef8a5b3d0808c67c2c6ca921322d514e00
Instruction Fuzzy Hash: AA11DCB1500714EFDB10DFA8EC48BAE7BEAEB91316F104898F445A7221CB31AD01CB60

Function 00B214CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00B214FF
OpenProcessToken.ADVAPI32(00000000), ref: 00B21506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00B21515
CloseHandle.KERNEL32(00000004), ref: 00B21520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B2154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00B21563

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: e8d310a1ff1c5632a2b0ee2128a3d0971907fc2e78c8b675611bce11623dd7d8
Instruction ID: dd24e604663343730ada9ee4f11629464a092676ea2cf1398da6a2421d6554f4
Opcode Fuzzy Hash: e8d310a1ff1c5632a2b0ee2128a3d0971907fc2e78c8b675611bce11623dd7d8
Instruction Fuzzy Hash: DB11447250020DAFDB11DFA8ED49BDE7BAAEB48705F0440A4FA09A21A0C7718E61DB60

Function 00AE3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00AE3379,00AE2FE5), ref: 00AE3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00AE339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00AE33B7
SetLastError.KERNEL32(00000000,?,00AE3379,00AE2FE5), ref: 00AE3409

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a718222dde8c22758c49a98c23be3030995742f6d8e280597f3c0bfdf2738083
Instruction ID: 0b8c3e240e19dfc4c539f000c385ee2daa2be0c0939c513f78d0dd0dcc53eb5b
Opcode Fuzzy Hash: a718222dde8c22758c49a98c23be3030995742f6d8e280597f3c0bfdf2738083
Instruction Fuzzy Hash: 1E01D833609353BFAF262B777D8DA672EA4DB057B67300229F510871F1EF614D019664

Function 00AF2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00AF5686,00B03CD6,?,00000000,?,00AF5B6A,?,?,?,?,?,00AEE6D1,?,00B88A48), ref: 00AF2D78
_free.LIBCMT ref: 00AF2DAB
_free.LIBCMT ref: 00AF2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00AEE6D1,?,00B88A48,00000010,00AC4F4A,?,?,00000000,00B03CD6), ref: 00AF2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00AEE6D1,?,00B88A48,00000010,00AC4F4A,?,?,00000000,00B03CD6), ref: 00AF2DEC
_abort.LIBCMT ref: 00AF2DF2

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 093488c428d9e30bfc1ca24cd835a11cbc3e82276ee9f9eda012cb8ea0aac85d
Instruction ID: bf8968b66aeb916b5b05871d3e64be3eca66452067d15baa070e731822da1ffe
Opcode Fuzzy Hash: 093488c428d9e30bfc1ca24cd835a11cbc3e82276ee9f9eda012cb8ea0aac85d
Instruction Fuzzy Hash: 15F0C832545B0D2BD61237F4BD1AF7F296AAFC17A1F240519FB24931E2EF7489014360

Function 00B58A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00AD9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AD9693
Part of subcall function 00AD9639: SelectObject.GDI32(?,00000000), ref: 00AD96A2
Part of subcall function 00AD9639: BeginPath.GDI32(?), ref: 00AD96B9
Part of subcall function 00AD9639: SelectObject.GDI32(?,00000000), ref: 00AD96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00B58A4E
LineTo.GDI32(?,00000003,00000000), ref: 00B58A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00B58A70
LineTo.GDI32(?,00000000,00000003), ref: 00B58A80
EndPath.GDI32(?), ref: 00B58A90
StrokePath.GDI32(?), ref: 00B58AA0

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 6fae1224a7fb4e965bae34413ed17a387f2437b11cb0ec33723a261259b0c177
Instruction ID: fa7303aa773d8d3aad1c96bb99878be2598877f710498a5088e3bbc67a1cd787
Opcode Fuzzy Hash: 6fae1224a7fb4e965bae34413ed17a387f2437b11cb0ec33723a261259b0c177
Instruction Fuzzy Hash: B211DE7600024DFFDF119F94DC88FAA7F6DEB08355F048052BA15961A1CB719D55DFA0

Function 00B251FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B25218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00B25229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B25230
ReleaseDC.USER32(00000000,00000000), ref: 00B25238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00B2524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00B25261

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 2fa21875adb0be4cc223f9f71d431f676d39de1c6578e14a778b66ae109d7f90
Instruction ID: a744f337f4555fafc5b51b580a164a735feaae33419cee714a11e294d0ad2c16
Opcode Fuzzy Hash: 2fa21875adb0be4cc223f9f71d431f676d39de1c6578e14a778b66ae109d7f90
Instruction Fuzzy Hash: C1014F75A01719BFEB109BA59C49B5EBFB9EB48752F0440A5FA04A7281DA709900CBA0

Function 00AC1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AC1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00AC1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AC1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AC1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00AC1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AC1C22

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: e9d687d10914fe8a4970927d5bb13ffe8ea0881c99071ae69267e17844123a7e
Instruction ID: 959c4be189b17174962cd2af14fbd16f22501cec5919a937e94283a3bc48a985
Opcode Fuzzy Hash: e9d687d10914fe8a4970927d5bb13ffe8ea0881c99071ae69267e17844123a7e
Instruction Fuzzy Hash: B10167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00415BA15C4BA42C7F5A864CFE5

Function 00B2EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00B2EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00B2EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00B2EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B2EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B2EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B2EB75

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: ca7dd7fb471cfa0b612067fbbb531fb94ecbfbf9b86dacddeb76e658df481463
Instruction ID: ccc9803a0d194fc87f77e853a1e6d02cb34db93fb01771c927f2729622744b34
Opcode Fuzzy Hash: ca7dd7fb471cfa0b612067fbbb531fb94ecbfbf9b86dacddeb76e658df481463
Instruction Fuzzy Hash: F2F01D72140758BFE62157529C0DFAB3E7DEBCAB12F000198F611E20919BA05A0186B5

Function 00B17439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00B17452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00B17469
GetWindowDC.USER32(?), ref: 00B17475
GetPixel.GDI32(00000000,?,?), ref: 00B17484
ReleaseDC.USER32(?,00000000), ref: 00B17496
GetSysColor.USER32(00000005), ref: 00B174B0

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 184044881b74013625af144c33fbdbc97ca6e9018fdeea771573d131d1554819
Instruction ID: f68ffdff8a17089a84be9c2352b1f721ba022497c91edc422ed4e670e81a3a74
Opcode Fuzzy Hash: 184044881b74013625af144c33fbdbc97ca6e9018fdeea771573d131d1554819
Instruction Fuzzy Hash: 34011231444315EFEB516FA4EC49BAA7FB6FB04322F6101A4F916A32A1CF311E91EB50

Function 00B21874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B2187F
UnloadUserProfile.USERENV(?,?), ref: 00B2188B
CloseHandle.KERNEL32(?), ref: 00B21894
CloseHandle.KERNEL32(?), ref: 00B2189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00B218A5
HeapFree.KERNEL32(00000000), ref: 00B218AC

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 9a220833f805aabd7796d292675041710f1f7499990fc2d58e00cf932f43809c
Instruction ID: 3529554407a4185e06e1cd37d842fa8b7c6a9ddb165458f079e6d3f94af8d9c5
Opcode Fuzzy Hash: 9a220833f805aabd7796d292675041710f1f7499990fc2d58e00cf932f43809c
Instruction Fuzzy Hash: 44E0C236004705BFDA015BA1ED0CA0ABF6AFB49B22B108260F22692470CF72A4A2DB50

Function 00B2C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC7620: _wcslen.LIBCMT ref: 00AC7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B2C6EE
_wcslen.LIBCMT ref: 00B2C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B2C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00B2C7CA

Strings

0, xrefs: 00B2C6AF

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: c972cc92bfa39642290dad29bf0e4b8fee12d1728fcb8c086bba1154c8da0d95
Instruction ID: 5fba6f5553d1d3bd49b28ff9bf3b81c32e02ce49c606e8ad999ddc784d8c1e01
Opcode Fuzzy Hash: c972cc92bfa39642290dad29bf0e4b8fee12d1728fcb8c086bba1154c8da0d95
Instruction Fuzzy Hash: BB5100716043219BD7119F28E885B6F7BE8EF49310F040AADF99AE32A0DB74DD04DB52

Function 00B4AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00B4AEA3

Part of subcall function 00AC7620: _wcslen.LIBCMT ref: 00AC7625

GetProcessId.KERNEL32(00000000), ref: 00B4AF38
CloseHandle.KERNEL32(00000000), ref: 00B4AF67

Strings

<, xrefs: 00B4AE6B
@, xrefs: 00B4AE72

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: d0734fd2838eb85e722603009c59aef6b290dcf294da13a0464a09084e36b8e1
Instruction ID: 8ff558e08d57af81861ffd60a54b02652930d50e1da83bd62b49a67c13773f9c
Opcode Fuzzy Hash: d0734fd2838eb85e722603009c59aef6b290dcf294da13a0464a09084e36b8e1
Instruction Fuzzy Hash: DB715670A00219DFCB14EF54C584A9EBBF0EF08314F15849DE81AAB3A2CB74EE45DB91

Function 00B2719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B27206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00B2723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00B2724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00B272CF

Strings

DllGetClassObject, xrefs: 00B27242

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: d26ef9018ee31d30344cb1d90070535a2f5e78f4b45b6ed6f0e8363f34d0a8be
Instruction ID: ae9a6666de0595e96ad48142d2e9f6c8994a68c74e71e20e91e7b9c4fc77f759
Opcode Fuzzy Hash: d26ef9018ee31d30344cb1d90070535a2f5e78f4b45b6ed6f0e8363f34d0a8be
Instruction Fuzzy Hash: 84414871A44214EFDB15CF54E884B9ABBE9EF49310B1580EDFD099F20ADBB0D944CBA4

Function 00B53D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B53E35
IsMenu.USER32(?), ref: 00B53E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B53E92
DrawMenuBar.USER32 ref: 00B53EA5

Strings

0, xrefs: 00B53D89

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 03d394bab25f62cf625d579149b65ea6815932ad2c34f761a63a333266f30c5d
Instruction ID: e22407d560c30cd9240e9110bb9e425e58f9e109ff823d39d1113d73a1fc5c9e
Opcode Fuzzy Hash: 03d394bab25f62cf625d579149b65ea6815932ad2c34f761a63a333266f30c5d
Instruction Fuzzy Hash: FD412575A00209EFDB10DF94D885BAABBF9FB48795F0441A9ED05AB350D730AE49CB60

Function 00B21DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

Part of subcall function 00B23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B23CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00B21E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00B21E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00B21EA9

Part of subcall function 00AC6B57: _wcslen.LIBCMT ref: 00AC6B6A

Strings

ListBox, xrefs: 00B21E25
ComboBox, xrefs: 00B21DF0

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: cf268fea7ffe9b5355176c03ebc1a44fda1f5eb2a1aa35dde02e711bcacea5b9
Instruction ID: b58d11bf9c61666c970e82de141f291c765861eb428ff88e84fb0e18bf4d2baf
Opcode Fuzzy Hash: cf268fea7ffe9b5355176c03ebc1a44fda1f5eb2a1aa35dde02e711bcacea5b9
Instruction Fuzzy Hash: 62212971A00204BEDB14AB64ED45DFFBBF9DF55350B114569F829A71E1DB344E098720

Function 00B4C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B4C9F1
_wcslen.LIBCMT ref: 00B4CA68
_wcslen.LIBCMT ref: 00B4CA9E
_wcslen.LIBCMT ref: 00B4CAF9
_wcslen.LIBCMT ref: 00B4CB2F
_wcslen.LIBCMT ref: 00B4CB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 00B4CA62, 00B4CA67
HKLM, xrefs: 00B4CA98, 00B4CA9D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 5e4d912e17da4e7f68d577f0cfa2b8197b92819241f5f561cf7e53a5d876a7d8
Instruction ID: 07a7cfff2b415267cb68396927236e6667882d1347d7ca35d2e8ed5ccc8bc60c
Opcode Fuzzy Hash: 5e4d912e17da4e7f68d577f0cfa2b8197b92819241f5f561cf7e53a5d876a7d8
Instruction Fuzzy Hash: 0531273360216A4ACB60EE2C89405BE3BD1DB61B44B1540A9E8516B25DFA70CF40E3A0

Function 00B52F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00B52F8D
LoadLibraryW.KERNEL32(?), ref: 00B52F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00B52FA9
DestroyWindow.USER32(?), ref: 00B52FB1

Strings

SysAnimate32, xrefs: 00B52F68

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 2f819ed9ab21a1959a3b67768d0f57777f04bb0e2fc537e604a4c2c5df84e94b
Instruction ID: 6e70e4be72a9d9b5e6c053cd0755aee68f8efbc1f1e8afe25a187fc6587131be
Opcode Fuzzy Hash: 2f819ed9ab21a1959a3b67768d0f57777f04bb0e2fc537e604a4c2c5df84e94b
Instruction Fuzzy Hash: 6B21B872205305ABEB104F64AC80FBB37F9EB6A326F104298FE10A31A0C631DC459B60

Function 00AE4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00AE4D1E,00AF28E9,?,00AE4CBE,00AF28E9,00B888B8,0000000C,00AE4E15,00AF28E9,00000002), ref: 00AE4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AE4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00AE4D1E,00AF28E9,?,00AE4CBE,00AF28E9,00B888B8,0000000C,00AE4E15,00AF28E9,00000002,00000000), ref: 00AE4DC3

Strings

CorExitProcess, xrefs: 00AE4D98
mscoree.dll, xrefs: 00AE4D86

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6e8c878974a5b598c1723d3235c0ae2653864190b37fb40c1d82c136c0c09911
Instruction ID: 618fad4209f4ecf3aca2a5e1bd98b29bc1bca896577632986e0ed4238e67846b
Opcode Fuzzy Hash: 6e8c878974a5b598c1723d3235c0ae2653864190b37fb40c1d82c136c0c09911
Instruction Fuzzy Hash: 3BF03C34A40308AFDB119F91DC49BAEBFA9EF48752F0000A4A809A3260CF745D40CB90

Function 00B1D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00B1D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00B1D3BF
FreeLibrary.KERNEL32(00000000), ref: 00B1D3E5

Strings

X64, xrefs: 00B1D2A8
GetSystemWow64DirectoryW, xrefs: 00B1D3B9

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 158c27770815d5b816610538b60dbb862a1e8d5d6b9f429347dd7aa9659a8a00
Instruction ID: e3828038d7ea5cb9575091bc8c0873816d0258531b7e02a6c7544e10ab610de5
Opcode Fuzzy Hash: 158c27770815d5b816610538b60dbb862a1e8d5d6b9f429347dd7aa9659a8a00
Instruction Fuzzy Hash: 9FF0A035405B259FD7652710CC98BEA7BA5AF11702BE481D6E916F2118DF70CDC08AD6

Function 00AC4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AC4EDD,?,00B91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AC4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00AC4EAE
FreeLibrary.KERNEL32(00000000,?,?,00AC4EDD,?,00B91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AC4EC0

Strings

kernel32.dll, xrefs: 00AC4E94
Wow64DisableWow64FsRedirection, xrefs: 00AC4EA8

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 26db01eeb35b1feb71d49a41857322dffc930df9db9ed50e90b17b7c27a6c99b
Instruction ID: 8281b4146b91cfc143b7e12f6813ccb0bf0513a4fc154ed1925b9e47e84859bd
Opcode Fuzzy Hash: 26db01eeb35b1feb71d49a41857322dffc930df9db9ed50e90b17b7c27a6c99b
Instruction Fuzzy Hash: EAE08635A05B225F922117256C28F9B6A95AF85F637070199FC04F3110DF64CD0185A4

Function 00AC4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B03CDE,?,00B91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AC4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00AC4E74
FreeLibrary.KERNEL32(00000000,?,?,00B03CDE,?,00B91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AC4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00AC4E6E
kernel32.dll, xrefs: 00AC4E5B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 61fb437dab4f86d549246ef9f831a501309bb195ae241de0f20b0f7ec0fcc73c
Instruction ID: 77111c4f658eb63e3685573a1886b750119b4a7f1af3e428e905d2f59a2baed8
Opcode Fuzzy Hash: 61fb437dab4f86d549246ef9f831a501309bb195ae241de0f20b0f7ec0fcc73c
Instruction Fuzzy Hash: C4D01235502B215B56221B297C28FCB6E99AF89F523070599FD05B3125CF60CD01C5D4

Function 00B32947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B32C05
DeleteFileW.KERNEL32(?), ref: 00B32C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00B32C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B32CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B32CC0

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: f6c6d56da04941a5ef4e56f86fb12236fd3ac0b608eb6b40dfd85ecf8b00fb07
Instruction ID: 3e0c3892cb9f42d3e8f3fe04098708aff0cf5bc9ae76de62e714d3426806da77
Opcode Fuzzy Hash: f6c6d56da04941a5ef4e56f86fb12236fd3ac0b608eb6b40dfd85ecf8b00fb07
Instruction Fuzzy Hash: CBB13E71D00219AFDF25DBA4CD85EDEBBBDEF48350F1040A6F609E7151EA31AA848F61

Function 00B4A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00B4A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00B4A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00B4A468
CloseHandle.KERNEL32(?), ref: 00B4A63D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: d91be69c9dc5427c52c1ddc45abc3e82d5512e1d01d6b0e0191728bd286cfdb1
Instruction ID: 0e35cfbda9738a60513490ed99ba60237fe1b675cbea1d3910dc133e00fbdd83
Opcode Fuzzy Hash: d91be69c9dc5427c52c1ddc45abc3e82d5512e1d01d6b0e0191728bd286cfdb1
Instruction Fuzzy Hash: BDA1AEB1604300AFD720DF24C986F2AB7E5EF84714F15885DF59A9B392DBB0ED418B92

Function 00B2E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B2CF22,?), ref: 00B2DDFD

Part of subcall function 00B2DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B2CF22,?), ref: 00B2DE16

Part of subcall function 00B2E199: GetFileAttributesW.KERNEL32(?,00B2CF95), ref: 00B2E19A

lstrcmpiW.KERNEL32(?,?), ref: 00B2E473
MoveFileW.KERNEL32(?,?), ref: 00B2E4AC
_wcslen.LIBCMT ref: 00B2E5EB
_wcslen.LIBCMT ref: 00B2E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00B2E650

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 2a5212242057412f388459a1a787f65133a690105a15d1587c1c383e556a677d
Instruction ID: 6bd86a40e70276374487116aaf036ea4a264f24efd82d94cda55bbd8404e783d
Opcode Fuzzy Hash: 2a5212242057412f388459a1a787f65133a690105a15d1587c1c383e556a677d
Instruction Fuzzy Hash: 905151B24083955BC724EBA1D881ADF77ECEF84340F00496EF699D3191EF74E6888766

Function 00B4B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

Part of subcall function 00B4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B4B6AE,?,?), ref: 00B4C9B5
Part of subcall function 00B4C998: _wcslen.LIBCMT ref: 00B4C9F1
Part of subcall function 00B4C998: _wcslen.LIBCMT ref: 00B4CA68
Part of subcall function 00B4C998: _wcslen.LIBCMT ref: 00B4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B4BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B4BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00B4BB63
RegCloseKey.ADVAPI32(?,?), ref: 00B4BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00B4BBB3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 6e8bdcf2870d07b8630380c0790675d2028424b7585727fb8c6cd9a887c83cd1
Instruction ID: c5871f142e9f95e197844a7779ec60312d9a297ee057d74d1b792fca83513b41
Opcode Fuzzy Hash: 6e8bdcf2870d07b8630380c0790675d2028424b7585727fb8c6cd9a887c83cd1
Instruction Fuzzy Hash: 9D618031208241AFD714DF14C895F2ABBE5FF84308F14859CF5994B2A2DB31EE45DB92

Function 00B28BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B28BCD
VariantClear.OLEAUT32 ref: 00B28C3E
VariantClear.OLEAUT32 ref: 00B28C9D
VariantClear.OLEAUT32(?), ref: 00B28D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00B28D3B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: a7db2a6180e394388d76a358f14546938521a4493165c299f18c20cc1d46d078
Instruction ID: cb236b0c4b9c2f19e750890ad970f327c2780f5b2d43e5372d0c184a48943546
Opcode Fuzzy Hash: a7db2a6180e394388d76a358f14546938521a4493165c299f18c20cc1d46d078
Instruction Fuzzy Hash: 20516CB5A01219EFDB10CF58D894EAAB7F5FF89310B1585A9E909DB350E730E911CF90

Function 00B38AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00B38BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00B38BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00B38C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00B38C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00B38C5F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 9248ec7919b5dc1aad6302b0fcbc9edcc91b913cf4b3e5a174cf30141272466f
Instruction ID: 9c0f2b7ff232eb0691a187b89c3b50e7e185d0277b72de60b3fcdd9556dc5109
Opcode Fuzzy Hash: 9248ec7919b5dc1aad6302b0fcbc9edcc91b913cf4b3e5a174cf30141272466f
Instruction Fuzzy Hash: 70513835A002199FCB01DF64C981E6EBBE5FF48314F098498E84AAB362DB31ED51CF91

Function 00B48EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00B48F40
GetProcAddress.KERNEL32(00000000,?), ref: 00B48FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00B48FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00B49032
FreeLibrary.KERNEL32(00000000), ref: 00B49052

Part of subcall function 00ADF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00B31043,?,753CE610), ref: 00ADF6E6
Part of subcall function 00ADF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00B1FA64,00000000,00000000,?,?,00B31043,?,753CE610,?,00B1FA64), ref: 00ADF70D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 45ae7d1ba83c875e15b41d88fed2678d7a306b4bfa4faf91539a03df8a9bdeff
Instruction ID: b41d031262f751a80321281406895ea1888452188f9d132aa13adac9a8beff66
Opcode Fuzzy Hash: 45ae7d1ba83c875e15b41d88fed2678d7a306b4bfa4faf91539a03df8a9bdeff
Instruction Fuzzy Hash: A5513B35600205DFCB11DF68C594DAEBBF1FF49314B0584A9E80AAB362DB31EE85DB91

Function 00B56B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00B56C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00B56C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00B56C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00B3AB79,00000000,00000000), ref: 00B56C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00B56CC7

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 314b5c8c7972a0629a8b94a51ede02ea54d180dfe3015832dac6198de8b16fe7
Instruction ID: b0a6ebd4ad2e417ac3d11738eb874c6f6862d5698bda8775961919a3d5eac88b
Opcode Fuzzy Hash: 314b5c8c7972a0629a8b94a51ede02ea54d180dfe3015832dac6198de8b16fe7
Instruction Fuzzy Hash: 4941E435A04204AFD725CF28CD99FA97FE5EB09361F9402E8FC95AB2E0C771AD45DA40

Function 00AF2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00AF20C3
_free.LIBCMT ref: 00AF20E3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 7a99ffd1075a8f395ad1778c358384fc41323049cd6ac878c2668f4ddce9ee56
Instruction ID: 37948633c3c1ebeb13537e347a47a11888f4e96b13c9da474e5fccf3807454cb
Opcode Fuzzy Hash: 7a99ffd1075a8f395ad1778c358384fc41323049cd6ac878c2668f4ddce9ee56
Instruction Fuzzy Hash: 9741B272A002089FCB24DFB8C981B6EB7B5EF89314F154569F616EB391DB31AD01CB90

Function 00AD912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00AD9141
ScreenToClient.USER32(00000000,?), ref: 00AD915E
GetAsyncKeyState.USER32(00000001), ref: 00AD9183
GetAsyncKeyState.USER32(00000002), ref: 00AD919D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 21e5123020901cc7f3730131ed44658da3b1768bef4095cd2129e91834dcc807
Instruction ID: fa562eaf699797b9b4eda3e8798444300413adf34b541db60a5acab49c3243ec
Opcode Fuzzy Hash: 21e5123020901cc7f3730131ed44658da3b1768bef4095cd2129e91834dcc807
Instruction Fuzzy Hash: 8441307190861AFBDF199F64C844BEEB7B5FB05324F204356F429A7290CB34A994CF91

Function 00B33874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00B338CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00B33922
TranslateMessage.USER32(?), ref: 00B3394B
DispatchMessageW.USER32(?), ref: 00B33955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B33966

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: e91a3ac4b42fa96dd9b6dd7b71e6457727e8b3f646420250fbe0b742bafc8396
Instruction ID: 03cd3c832b07668c6f05fda328b6cf60265aff6cd9e0dd9784fbd1091eecb2d9
Opcode Fuzzy Hash: e91a3ac4b42fa96dd9b6dd7b71e6457727e8b3f646420250fbe0b742bafc8396
Instruction Fuzzy Hash: 0D31DB70504342EEEB35CB389949B773BE4DB15700F2406DAE453C31A0EBB49A85DB21

Function 00B3CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00B3CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00B3CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00B3C21E,00000000), ref: 00B3CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00B3C21E,00000000), ref: 00B3CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00B3C21E,00000000), ref: 00B3CFF2

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: f0418459de21849e06fbb8dfa157ee31ed052f9f06171a21e914f6a1f1135a7b
Instruction ID: 01a972bd1ee80d77501f11ee235e0e01d5e8ab31559f0091258661de3c242a18
Opcode Fuzzy Hash: f0418459de21849e06fbb8dfa157ee31ed052f9f06171a21e914f6a1f1135a7b
Instruction Fuzzy Hash: 67313A71500705AFDB20DFA5C984AABBFFAEB14355F2044AEE506E3141DB30AE499B60

Function 00B21901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B21915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00B219C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00B219C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00B219DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00B219E2

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 009e86590fe90b426d33ba349b4f80946e16186da7e5f69d22af00a3f3be7125
Instruction ID: c0f3d63b6f6b0e855ab8e7df504120f0924453c08bf550f429ec94747a41043a
Opcode Fuzzy Hash: 009e86590fe90b426d33ba349b4f80946e16186da7e5f69d22af00a3f3be7125
Instruction Fuzzy Hash: FE31D171900229EFCB00CFACDD98BDE3BB5EB14315F104665F925A72D0C7709A85CB90

Function 00B55706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00B55745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00B5579D
_wcslen.LIBCMT ref: 00B557AF
_wcslen.LIBCMT ref: 00B557BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B55816

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 47590c59114e53932a0e2377e2a9bbecc9b64cad22fbde76aba558aaefbb3cd8
Instruction ID: 53cdc0677ecdb830e116a0be6aa94abcc903e3540c706304c111c6b65c4d2f43
Opcode Fuzzy Hash: 47590c59114e53932a0e2377e2a9bbecc9b64cad22fbde76aba558aaefbb3cd8
Instruction Fuzzy Hash: AF2161719046189ADB209FA4CC85BED7BF8FF04726F1082D6ED29AB184D7709A89CF50

Function 00B40930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00B40951
GetForegroundWindow.USER32 ref: 00B40968
GetDC.USER32(00000000), ref: 00B409A4
GetPixel.GDI32(00000000,?,00000003), ref: 00B409B0
ReleaseDC.USER32(00000000,00000003), ref: 00B409E8

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 7b7e0696354100cdc15e9a5d0900007153bbe84ef7ee17a275ffa9390d9ea6fe
Instruction ID: 891eb5483156a5c30c20b69dfe2511a6f801d13668e1babc753b4e0182937338
Opcode Fuzzy Hash: 7b7e0696354100cdc15e9a5d0900007153bbe84ef7ee17a275ffa9390d9ea6fe
Instruction Fuzzy Hash: 5E218135600314AFD704EF69C985AAEBBE9EF48701F1484ADE84AA7752CB30AD04DB50

Function 00AFCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00AFCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AFCDE9

Part of subcall function 00AF3820: RtlAllocateHeap.NTDLL(00000000,?,00B91444,?,00ADFDF5,?,?,00ACA976,00000010,00B91440,00AC13FC,?,00AC13C6,?,00AC1129), ref: 00AF3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00AFCE0F
_free.LIBCMT ref: 00AFCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00AFCE31

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 65eab743547a41b083ea21ed3c18562ba3b8aeff444e8b06fc3f2db60c009447
Instruction ID: c47b1f009189ece1bc85c7e829596a1e16708acd9e100928ed2bde0f5fa720ae
Opcode Fuzzy Hash: 65eab743547a41b083ea21ed3c18562ba3b8aeff444e8b06fc3f2db60c009447
Instruction Fuzzy Hash: 5D01D472A0171D7FA32117F7AD88DBB6E6DDEC6BB13150169FA05D7200EE658D0181F0

Function 00AD9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AD9693
SelectObject.GDI32(?,00000000), ref: 00AD96A2
BeginPath.GDI32(?), ref: 00AD96B9
SelectObject.GDI32(?,00000000), ref: 00AD96E2

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: d15adbec16fbc19bac587a1a905422135641a90ca7bf2fba8590457dd8e5a28f
Instruction ID: f50f88fc078d94e7e19c09dfed2db7de3c0cb7d5580438111ca41aebbab4fd8f
Opcode Fuzzy Hash: d15adbec16fbc19bac587a1a905422135641a90ca7bf2fba8590457dd8e5a28f
Instruction Fuzzy Hash: F2218030802306EFDB119F68EE047AA3FB9BB00356F504657F412A72B0DB70D892DBA4

Function 00B25711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00B25726
_memcmp.LIBVCRUNTIME ref: 00B25744
_memcmp.LIBVCRUNTIME ref: 00B25757
_memcmp.LIBVCRUNTIME ref: 00B2576F
_memcmp.LIBVCRUNTIME ref: 00B25787

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 0a60842f021c2c84df0c60166c027a3953c69d884e797502c2593a9619fd85e1
Instruction ID: 1ffbc281a492314c7f1123ab4ffa7a69b7748636d342858ffef568725869a297
Opcode Fuzzy Hash: 0a60842f021c2c84df0c60166c027a3953c69d884e797502c2593a9619fd85e1
Instruction Fuzzy Hash: DB01B57178166AFBD2289511AE82FBBB3DCDB213A5F0040B0FD0C9E251F770ED1486A1

Function 00AF2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00AEF2DE,00AF3863,00B91444,?,00ADFDF5,?,?,00ACA976,00000010,00B91440,00AC13FC,?,00AC13C6), ref: 00AF2DFD
_free.LIBCMT ref: 00AF2E32
_free.LIBCMT ref: 00AF2E59
SetLastError.KERNEL32(00000000,00AC1129), ref: 00AF2E66
SetLastError.KERNEL32(00000000,00AC1129), ref: 00AF2E6F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 4eac904232aa5311a943238f3e4b304fd9cc3ebb8e78f4999d46282606aa6d9a
Instruction ID: be6efde5179d0174bf138bcdd5f7bd3da105b166f3d8e3d911cfe9f01952248e
Opcode Fuzzy Hash: 4eac904232aa5311a943238f3e4b304fd9cc3ebb8e78f4999d46282606aa6d9a
Instruction Fuzzy Hash: 9101F97224570C6BC61227F4AD85F3B1D6AAFD17A17340025FB61A31A2EF748C014320

Function 00B2000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B1FF41,80070057,?,?,?,00B2035E), ref: 00B2002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B1FF41,80070057,?,?), ref: 00B20046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B1FF41,80070057,?,?), ref: 00B20054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B1FF41,80070057,?), ref: 00B20064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B1FF41,80070057,?,?), ref: 00B20070

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 4f6c655666b2cd07cd3088dd729ac8508b08449fe3a0422473be7813ab9ff756
Instruction ID: 700f1cd8d97322878475784b0c4d9695b0c91b7746e5075ec73a6b41400a4936
Opcode Fuzzy Hash: 4f6c655666b2cd07cd3088dd729ac8508b08449fe3a0422473be7813ab9ff756
Instruction Fuzzy Hash: A5017172610318AFEB116F64EC44BBA7EEEEB44752F144194F909D3221DB75DD408760

Function 00B210F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B21114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00B20B9B,?,?,?), ref: 00B21120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B20B9B,?,?,?), ref: 00B2112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B20B9B,?,?,?), ref: 00B21136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B2114D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: ec2f1d0df0fdb1c5810b387929e9435395cedda0fa021d34bf5bde80ff3483ab
Instruction ID: e2163dd80a47e67ce04cf4ff49544e76641f69624d5db2af6bed4fdb65da681a
Opcode Fuzzy Hash: ec2f1d0df0fdb1c5810b387929e9435395cedda0fa021d34bf5bde80ff3483ab
Instruction Fuzzy Hash: D0016D75100315BFDB114F68EC49A6A3FAEEF89362B200494FA45E3350DE71DC10CA60

Function 00B20FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B20FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B20FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B20FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B20FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B21002

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 46c87a570a70aa276a482f7296f275ed4fb4c6cc18f4681f3eb7ad5b7c435d68
Instruction ID: c4d9e6c8c08e5299c8597dd1d3c1cab65a479fa1f62288ae8f83fe021db25846
Opcode Fuzzy Hash: 46c87a570a70aa276a482f7296f275ed4fb4c6cc18f4681f3eb7ad5b7c435d68
Instruction Fuzzy Hash: 74F04F35100315AFDB214FA9AC49F5B3FAEEF89762F104494FA49D7291CE70DC408A60

Function 00B21014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B2102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B21036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B21045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B2104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B21062

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: da83eb81a02bf555ebec993ceea636a4de68ab65779661eec913241bdaf16e4b
Instruction ID: f54ff22820da8726ca875ad868e8be77f6edec582b5fa8448f423c6b7fe7b8cf
Opcode Fuzzy Hash: da83eb81a02bf555ebec993ceea636a4de68ab65779661eec913241bdaf16e4b
Instruction Fuzzy Hash: 2DF04F35100355AFDB215FA9EC49F5B3FAEEF89762F100454FA49D7290CE70D8808A60

Function 00B3030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00B3017D,?,00B332FC,?,00000001,00B02592,?), ref: 00B30324
CloseHandle.KERNEL32(?,?,?,?,00B3017D,?,00B332FC,?,00000001,00B02592,?), ref: 00B30331
CloseHandle.KERNEL32(?,?,?,?,00B3017D,?,00B332FC,?,00000001,00B02592,?), ref: 00B3033E
CloseHandle.KERNEL32(?,?,?,?,00B3017D,?,00B332FC,?,00000001,00B02592,?), ref: 00B3034B
CloseHandle.KERNEL32(?,?,?,?,00B3017D,?,00B332FC,?,00000001,00B02592,?), ref: 00B30358
CloseHandle.KERNEL32(?,?,?,?,00B3017D,?,00B332FC,?,00000001,00B02592,?), ref: 00B30365

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c5dd969dfbbdf1a0452b1c54b4ae17f9ce7c712ea0335ebfaaeb70c962dde99c
Instruction ID: b079f7ed429638b2db395b704d9f632fe4da379f9672649c4a3b1ab2120d51e4
Opcode Fuzzy Hash: c5dd969dfbbdf1a0452b1c54b4ae17f9ce7c712ea0335ebfaaeb70c962dde99c
Instruction Fuzzy Hash: CB01EA72800B059FCB30AF66D8A0812FBF9FF603053248A7FD19252930C3B0A988CF84

Function 00AFD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00AFD752

Part of subcall function 00AF29C8: HeapFree.KERNEL32(00000000,00000000,?,00AFD7D1,00000000,00000000,00000000,00000000,?,00AFD7F8,00000000,00000007,00000000,?,00AFDBF5,00000000), ref: 00AF29DE
Part of subcall function 00AF29C8: GetLastError.KERNEL32(00000000,?,00AFD7D1,00000000,00000000,00000000,00000000,?,00AFD7F8,00000000,00000007,00000000,?,00AFDBF5,00000000,00000000), ref: 00AF29F0

_free.LIBCMT ref: 00AFD764
_free.LIBCMT ref: 00AFD776
_free.LIBCMT ref: 00AFD788
_free.LIBCMT ref: 00AFD79A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3e1cbfb611140507d59609dd31dd13aa4cb57e77ae6b5b76583b6abd05370853
Instruction ID: 7f79c0bec25ad1474a3bb07ec9b6140313f38d4b63eff181e2bb26b029632c33
Opcode Fuzzy Hash: 3e1cbfb611140507d59609dd31dd13aa4cb57e77ae6b5b76583b6abd05370853
Instruction Fuzzy Hash: 60F0F47258420D6B8612FB94F9C5D367BDEBB447107940805F254EB511CB70FC408774

Function 00B25C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00B25C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00B25C6F
MessageBeep.USER32(00000000), ref: 00B25C87
KillTimer.USER32(?,0000040A), ref: 00B25CA3
EndDialog.USER32(?,00000001), ref: 00B25CBD

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: a5a5fc5c906056221770024354dcd77df67a2040cad99e7356f48d34ad441272
Instruction ID: a5c1e67b719405d22828b9cc5d45cc5718eafdbb12e1578826c269d6be494add
Opcode Fuzzy Hash: a5a5fc5c906056221770024354dcd77df67a2040cad99e7356f48d34ad441272
Instruction Fuzzy Hash: 4B013B30500714AFEB355B10ED4EFD57BF9FB04706F0415D9A547624E1EBF46A448A50

Function 00AF22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00AF22BE

Part of subcall function 00AF29C8: HeapFree.KERNEL32(00000000,00000000,?,00AFD7D1,00000000,00000000,00000000,00000000,?,00AFD7F8,00000000,00000007,00000000,?,00AFDBF5,00000000), ref: 00AF29DE
Part of subcall function 00AF29C8: GetLastError.KERNEL32(00000000,?,00AFD7D1,00000000,00000000,00000000,00000000,?,00AFD7F8,00000000,00000007,00000000,?,00AFDBF5,00000000,00000000), ref: 00AF29F0

_free.LIBCMT ref: 00AF22D0
_free.LIBCMT ref: 00AF22E3
_free.LIBCMT ref: 00AF22F4
_free.LIBCMT ref: 00AF2305

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b9145b4074d68707bf4c48d52a08f541eef0185bdf5ce35e5a7041c0fcf3e7e3
Instruction ID: c6b8c932150f0da95da68aa8eba5fa29d7f346a2dd910554aea1b81d1d0cd6ad
Opcode Fuzzy Hash: b9145b4074d68707bf4c48d52a08f541eef0185bdf5ce35e5a7041c0fcf3e7e3
Instruction Fuzzy Hash: C8F05EB18901268F8612BF98BE41A683FA4FB68760700090BF554D73B1CF700911EFE4

Function 00AD95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00AD95D4
StrokeAndFillPath.GDI32(?,?,00B171F7,00000000,?,?,?), ref: 00AD95F0
SelectObject.GDI32(?,00000000), ref: 00AD9603
DeleteObject.GDI32 ref: 00AD9616
StrokePath.GDI32(?), ref: 00AD9631

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: a4595f9f7bcc34f66a12c665af1325dbb310c75c924ad96a49a84998780e868d
Instruction ID: dfd594c2083f2061c21c6d4c007f08f82105726241c63f29a9510b7ee0852da1
Opcode Fuzzy Hash: a4595f9f7bcc34f66a12c665af1325dbb310c75c924ad96a49a84998780e868d
Instruction Fuzzy Hash: FCF01930005705EFDB125F69EE187653F62BB00362F048256F426571F1CF318996EF20

Function 00AF0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00AF10F9
__freea.LIBCMT ref: 00AF1117

Part of subcall function 00AF1537: _free.LIBCMT ref: 00AF154F

Strings

a/p, xrefs: 00AF11DE
am/pm, xrefs: 00AF117A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 7e194f3c94d79f67c18fa7935a4467546fea9fc4cf93fb9b0c9c06f143c91718
Instruction ID: 6cff804f6bda8e7f1548599875b76a67604b5f8df388eb0e5b2721bfe378bf05
Opcode Fuzzy Hash: 7e194f3c94d79f67c18fa7935a4467546fea9fc4cf93fb9b0c9c06f143c91718
Instruction Fuzzy Hash: 5FD1F13190020EDADB689FE8C895BFAB7B5EF15300F284269FB01AF651D7759D80CB91

Function 00B47B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00AE0242: EnterCriticalSection.KERNEL32(00B9070C,00B91884,?,?,00AD198B,00B92518,?,?,?,00AC12F9,00000000), ref: 00AE024D
Part of subcall function 00AE0242: LeaveCriticalSection.KERNEL32(00B9070C,?,00AD198B,00B92518,?,?,?,00AC12F9,00000000), ref: 00AE028A

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

Part of subcall function 00AE00A3: __onexit.LIBCMT ref: 00AE00A9

__Init_thread_footer.LIBCMT ref: 00B47BFB

Part of subcall function 00AE01F8: EnterCriticalSection.KERNEL32(00B9070C,?,?,00AD8747,00B92514), ref: 00AE0202
Part of subcall function 00AE01F8: LeaveCriticalSection.KERNEL32(00B9070C,?,00AD8747,00B92514), ref: 00AE0235

Strings

5, xrefs: 00B47C78
G, xrefs: 00B47C7F
Variable must be of type 'Object'., xrefs: 00B47C3A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 6bf204fb7cca3752d523711fb3cfe166f0624e4da8f5a7606c32dc8f3dc359ab
Instruction ID: 652f6773c41d1d613a6264c708e7b311b6f8071b45ee6620446eae1131f09a45
Opcode Fuzzy Hash: 6bf204fb7cca3752d523711fb3cfe166f0624e4da8f5a7606c32dc8f3dc359ab
Instruction Fuzzy Hash: 55917BB0A44209AFCB14EF94D991EBDB7F1EF44304F108099F806AB292DB71AE45EB51

Function 00B22716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B2B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B221D0,?,?,00000034,00000800,?,00000034), ref: 00B2B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00B22760

Part of subcall function 00B2B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B221FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00B2B3F8

Part of subcall function 00B2B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00B2B355
Part of subcall function 00B2B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00B22194,00000034,?,?,00001004,00000000,00000000), ref: 00B2B365
Part of subcall function 00B2B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00B22194,00000034,?,?,00001004,00000000,00000000), ref: 00B2B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B227CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B2281A

Strings

@, xrefs: 00B22832

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 45030a90345ec8779cc8a014c33df5b4ecffce4ddbed0b0ab9d3811df64f84be
Instruction ID: be4d527ac3579f67ad99bb0d6a0f81ba7e8b7ea035c0eeb0aa631d3782aca490
Opcode Fuzzy Hash: 45030a90345ec8779cc8a014c33df5b4ecffce4ddbed0b0ab9d3811df64f84be
Instruction Fuzzy Hash: 7D41FC76900228BEDB10DBA4D985EDEBBB8EF05700F104095EA59B7191DA706E45CB61

Function 00AF172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00AF1769
_free.LIBCMT ref: 00AF1834
_free.LIBCMT ref: 00AF183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00AF1760, 00AF1767, 00AF1796, 00AF17CE

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 610271b69d7ffb487702ebc28ca5949fc569e4380e8a345ca14513e527018ac9
Instruction ID: 57c293e98b3045ec83c845bf82b282805e97265a5d28d568bfe68b131f4ab646
Opcode Fuzzy Hash: 610271b69d7ffb487702ebc28ca5949fc569e4380e8a345ca14513e527018ac9
Instruction Fuzzy Hash: B3318071A0021CEFDB21EBD99A81DAEBBFCEB85350F204166F60497211DB708E40DBD0

Function 00B2C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00B2C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00B2C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00B91990,018E5798), ref: 00B2C395

Strings

0, xrefs: 00B2C2DF

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 3d45a6a1584c9be1d4444597776741a8cd9e9e9eed19f17d5ae7f13c4c1910bc
Instruction ID: 74a989101a16fb78d3f0ddd0c10f263e8e2fbbcd012df3535de6394f31704b11
Opcode Fuzzy Hash: 3d45a6a1584c9be1d4444597776741a8cd9e9e9eed19f17d5ae7f13c4c1910bc
Instruction Fuzzy Hash: 8A419F312043519FD720DF25E885B5EBFE4EF95310F108A9DF8A997292DB30A904CB5A

Function 00B54416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00B5CC08,00000000,?,?,?,?), ref: 00B544AA
GetWindowLongW.USER32 ref: 00B544C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B544D7

Strings

SysTreeView32, xrefs: 00B5447C

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: d95fcaa82d0faabe3c4e99443901064ef478d46b92c0dc667ec01bdafa9f1573
Instruction ID: ad649bdd5d588bd917f6ab88ec540307559f5a4687cce38fda0592cbe82a46cf
Opcode Fuzzy Hash: d95fcaa82d0faabe3c4e99443901064ef478d46b92c0dc667ec01bdafa9f1573
Instruction Fuzzy Hash: 5E319E31240205AFDF219E38DC45BEA7BA9EB08329F204795FD79A32E0DB70EC959750

Function 00B4304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00B43077,?,?), ref: 00B43378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00B4307A
_wcslen.LIBCMT ref: 00B4309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00B43106

Strings

255.255.255.255, xrefs: 00B43095, 00B4309A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 614d02a818f6a9740a73257f37fbeac13b437b09731e8d8970ffaac9769e071c
Instruction ID: 1c15bb28c6053e496237433975ef71354570fd7791cdd4cd74ed505f40688ef5
Opcode Fuzzy Hash: 614d02a818f6a9740a73257f37fbeac13b437b09731e8d8970ffaac9769e071c
Instruction Fuzzy Hash: BC31C1352002019FDB10CF68C585FAA77E1EF14718F2881D9E9159B392DB72EF41D761

Function 00B53EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00B53F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00B53F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B53F78

Strings

SysMonthCal32, xrefs: 00B53F0B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: c5956eaf033b8e07e1633afa8e6a7e0d094f8eb402fc2acb791148df81a93b50
Instruction ID: 3230f0df231d55e13ba5fa530614d2ec2d6ef5468d4f4a08986e77121c67766a
Opcode Fuzzy Hash: c5956eaf033b8e07e1633afa8e6a7e0d094f8eb402fc2acb791148df81a93b50
Instruction Fuzzy Hash: 6A21BF32600219BFDF118F50CC86FEA3BB9EB48754F110294FE157B1D0DAB1A954DBA0

Function 00B54653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00B54705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00B54713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00B5471A

Strings

msctls_updown32, xrefs: 00B54684

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 6de334258ff76c6506e092d5b1ae252d3b648c608773c405961c2dc6d626adde
Instruction ID: 0d5f5f676479c9b7d7877b565e365e429c2dd1d1d70f291f27d13438f3514e79
Opcode Fuzzy Hash: 6de334258ff76c6506e092d5b1ae252d3b648c608773c405961c2dc6d626adde
Instruction Fuzzy Hash: A72162B5600209AFDB11DF68DCC1EB737EDEB5A359B040499FA009B251CB30EC56DB60

Function 00B295AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B2961D

Strings

#notrayicon, xrefs: 00B295B7
#OnAutoItStartRegister, xrefs: 00B295F3
#requireadmin, xrefs: 00B295D9

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 4a3c5e6c0e9a3ef0cd9282d59308b40a62b2d6c39eee22aeb0bea3af013e65b8
Instruction ID: c1eb6e3210e50bb4f40761989cdfda785a9c2c8a418b44ef92fd49c0bc04782c
Opcode Fuzzy Hash: 4a3c5e6c0e9a3ef0cd9282d59308b40a62b2d6c39eee22aeb0bea3af013e65b8
Instruction Fuzzy Hash: C621353220422166D332AA29AD52FBBB3D8DFA5300F1040AAF94E97181EB55AD45C2A5

Function 00B537B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00B53840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00B53850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00B53876

Strings

Listbox, xrefs: 00B5380F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: e9be81fd2b77a18c0d35162ff4826753411f3766339b9b8963c38fcb243ff64d
Instruction ID: 4ef7d0024ecaa4baffe1d6fa5a84672b7120b156fb1afda57ad7b29f4253426f
Opcode Fuzzy Hash: e9be81fd2b77a18c0d35162ff4826753411f3766339b9b8963c38fcb243ff64d
Instruction Fuzzy Hash: 9721C5726002187BEF118F64CC81FBB37EEEF89B91F108194F9119B290CA71DC568BA0

Function 00B349F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B34A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00B34A5C
SetErrorMode.KERNEL32(00000000,?,?,00B5CC08), ref: 00B34AD0

Strings

%lu, xrefs: 00B34A6F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 890109fe67f9cd22826b7f48e0515903b8029a3b0c89da7841433912f9d623e4
Instruction ID: d46a316416f171e86ea0720ccfb602081c03735f0d14a3de18bfacabc024cb60
Opcode Fuzzy Hash: 890109fe67f9cd22826b7f48e0515903b8029a3b0c89da7841433912f9d623e4
Instruction Fuzzy Hash: 49314175A00209AFD710DF54C985FAA7BF9EF08304F144099F909DB262DB71ED45CB61

Function 00B541EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00B5424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00B54264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00B54271

Strings

msctls_trackbar32, xrefs: 00B54226

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: f339216a0a14a88decd477351499f5054faf12f8452aab586234a6f16e47113e
Instruction ID: bc96e2a6b4a8066dc20176b27c6c1092ea9092ccb457592d682cbdfd277e9d24
Opcode Fuzzy Hash: f339216a0a14a88decd477351499f5054faf12f8452aab586234a6f16e47113e
Instruction Fuzzy Hash: 9911E331250248BEEF205E29CC46FAB3BECEF85B59F114554FA55E70A0D672DC519B20

Function 00B22F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC6B57: _wcslen.LIBCMT ref: 00AC6B6A

Part of subcall function 00B22DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B22DC5
Part of subcall function 00B22DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B22DD6
Part of subcall function 00B22DA7: GetCurrentThreadId.KERNEL32 ref: 00B22DDD
Part of subcall function 00B22DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00B22DE4

GetFocus.USER32 ref: 00B22F78

Part of subcall function 00B22DEE: GetParent.USER32(00000000), ref: 00B22DF9

GetClassNameW.USER32(?,?,00000100), ref: 00B22FC3
EnumChildWindows.USER32(?,00B2303B), ref: 00B22FEB

Strings

%s%d, xrefs: 00B22FFF

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 85febd1a64f522a7f5892e3cda4eeb4905042c8b63aff3d32c38d8bfdbe07da2
Instruction ID: b7dc83dc2b282b6f4e877d1cd0a4e1334796e0ea7e91f274094df5eb3a4300cb
Opcode Fuzzy Hash: 85febd1a64f522a7f5892e3cda4eeb4905042c8b63aff3d32c38d8bfdbe07da2
Instruction Fuzzy Hash: 3911C0712002156BDF51BF609C95FEE37EAAF84304F0440B9B90D9B262DE349A498B70

Function 00B55882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00B558C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00B558EE
DrawMenuBar.USER32(?), ref: 00B558FD

Strings

0, xrefs: 00B5588F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: bd5d6419372a7e3c707456ce571bf2174f97390dcad912b9b13a5c40a22a7f83
Instruction ID: 311d5927cc518783c0c0f0b3ba2970d7e8bc4b6b9352313528965716097d7a21
Opcode Fuzzy Hash: bd5d6419372a7e3c707456ce571bf2174f97390dcad912b9b13a5c40a22a7f83
Instruction Fuzzy Hash: 32015E31500218EFDB219F51DC45BAFBBB5FB45362F1080D9E849D6261DF348A84DF61

Function 00B2007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db580756e1aacf7d64527f1c292411510bac3b700114b3edfcce7e300991b91b
Instruction ID: c7400bab8db7d894706c36bf0870183398bf2c48aec00008787deec04c95311d
Opcode Fuzzy Hash: db580756e1aacf7d64527f1c292411510bac3b700114b3edfcce7e300991b91b
Instruction Fuzzy Hash: 1CC16975A1022AEFDB04DFA4D894AAEB7F5FF48304F208599E509EB252C731ED41CB90

Function 00AF3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00AF3F0B
__alldvrm.LIBCMT ref: 00AF410C
__alldvrm.LIBCMT ref: 00AF412E

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: bbf33b6f9aefb4e571ab85c6c65ea913b041784ff927dc0d29078adecb0a92c6
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 9AA11772D0038A9FEB25CF98C8917BBBBF5EF69350F1442ADF6959B281C6388941C750

Function 00B4342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B43459
CoUninitialize.OLE32 ref: 00B43463
VariantInit.OLEAUT32(?), ref: 00B4346E
VariantClear.OLEAUT32(?), ref: 00B4371B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: dbe913e2a4ac4104b012ec6c79d03f581dc107e91ab43eb080bd7830b39e76fb
Instruction ID: 1b1e6ba3cf1eab7e4df73c969ef5f589d00f6544cdc91c708da8245854ab417c
Opcode Fuzzy Hash: dbe913e2a4ac4104b012ec6c79d03f581dc107e91ab43eb080bd7830b39e76fb
Instruction Fuzzy Hash: 41A116756043019FCB00DF28C585E2AB7E5EF88714F19889DF98A9B362DB31EE05DB91

Function 00B20436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00B5FC08,?), ref: 00B205F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00B5FC08,?), ref: 00B20608
CLSIDFromProgID.OLE32(?,?,00000000,00B5CC40,000000FF,?,00000000,00000800,00000000,?,00B5FC08,?), ref: 00B2062D
_memcmp.LIBVCRUNTIME ref: 00B2064E

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: b0decd829920503509b092f7ed6bbecf86692f2498b258caa3baa15827347761
Instruction ID: 22575dbd70d85fc12803b079c01c1eca407953d5a2b6d000eade7c4b6014f39d
Opcode Fuzzy Hash: b0decd829920503509b092f7ed6bbecf86692f2498b258caa3baa15827347761
Instruction Fuzzy Hash: B5813E71A10219EFCB04DF94C984EEEB7F9FF89315F204598E506AB251DB71AE06CB60

Function 00B01391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B014C0

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 209c58b22d254f1675a300c765e479366443753c28023988474d378bb4a477c7
Instruction ID: af25529ec7de9e89a135b8ff759baa2e2ca15ebf714fadfecf0bf60623a39d8c
Opcode Fuzzy Hash: 209c58b22d254f1675a300c765e479366443753c28023988474d378bb4a477c7
Instruction Fuzzy Hash: 19415935A00204AFDB296FFD8C85ABE3EE4EF51370F144AA5F518D73E2E73488415A62

Function 00B56278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B562E2
ScreenToClient.USER32(?,?), ref: 00B56315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00B56382

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 4a41b4c2879f38fc90bbf2f22e500248981f4bdb9709c35b52f53844eec2b333
Instruction ID: e646c55d3d7072571e8e63fa238e8dbaae10011826e6adb1d36475589c967cfe
Opcode Fuzzy Hash: 4a41b4c2879f38fc90bbf2f22e500248981f4bdb9709c35b52f53844eec2b333
Instruction Fuzzy Hash: 08513A74A00209EFDF11DF68D980AAE7BF6EB45361F5085E9F8159B2A0DB30ED85CB50

Function 00B41AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00B41AFD
WSAGetLastError.WSOCK32 ref: 00B41B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00B41B8A
WSAGetLastError.WSOCK32 ref: 00B41B94

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: d81c819bcff9d40f2413601f2f18999dc4c758087e114fe3fc62c5b350267c4f
Instruction ID: 6aee328dccc2b673916fbffa4acf9faa93d0dd54eb8dbcd898107c8db5de7084
Opcode Fuzzy Hash: d81c819bcff9d40f2413601f2f18999dc4c758087e114fe3fc62c5b350267c4f
Instruction Fuzzy Hash: D3418174A40300AFE720AF24C986F297BE5EB44718F54849CF91A9F7D2D772DD828B91

Function 00AFB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2be86016345ed7aeef5097a2d0005f301e81c68c7b081bd75ca3c7ac7b4928
Instruction ID: 23a5e9cfecefd8c7add9d519982b12c05efaf3c4a66fd010a44749b12a44821a
Opcode Fuzzy Hash: 6e2be86016345ed7aeef5097a2d0005f301e81c68c7b081bd75ca3c7ac7b4928
Instruction Fuzzy Hash: FF412A75A10708AFD724AFB8CD41BBABBF9EB84710F10856AF211DB681D371A9018B90

Function 00B356D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00B35783
GetLastError.KERNEL32(?,00000000), ref: 00B357A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00B357CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00B357FA

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: bbea8ae26f797c639548ff54b2705e8831779c7779f83d8afdd2608b7905d68c
Instruction ID: 89f31386cf39571a74447f7e022da9fa356e352bbc6a5a73c852397ed00adb9d
Opcode Fuzzy Hash: bbea8ae26f797c639548ff54b2705e8831779c7779f83d8afdd2608b7905d68c
Instruction Fuzzy Hash: 2C412B39600614DFCB21EF15C545A5EBBE2EF89720F198488E84AAB362CB35FD41DF91

Function 00AFD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00AE6D71,00000000,00000000,00AE82D9,?,00AE82D9,?,00000001,00AE6D71,8BE85006,00000001,00AE82D9,00AE82D9), ref: 00AFD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00AFD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00AFD9AB
__freea.LIBCMT ref: 00AFD9B4

Part of subcall function 00AF3820: RtlAllocateHeap.NTDLL(00000000,?,00B91444,?,00ADFDF5,?,?,00ACA976,00000010,00B91440,00AC13FC,?,00AC13C6,?,00AC1129), ref: 00AF3852

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 48d1394d781bc37e30f9a969d5f93c68e103d5e04ee5d63aedd45d9a492f5a26
Instruction ID: edfd02d1d03605a42eff0c5103ab10303ad0be1a93a331008cf754a0f64f6f37
Opcode Fuzzy Hash: 48d1394d781bc37e30f9a969d5f93c68e103d5e04ee5d63aedd45d9a492f5a26
Instruction Fuzzy Hash: 0531BE72A0020AABDF269FA5DC85EBE7BA6EB40350F054168FD04D7250EB75CD50CBA0

Function 00B552C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00B55352
GetWindowLongW.USER32(?,000000F0), ref: 00B55375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B55382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B553A8

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: f6f03e0461fee75aaec25282b1f81f24b923019eba341128af5dd98f7f0fb047
Instruction ID: 28dbadbc1e334240d7b0b129262151580cfe50920635e463ac6538bf8c07e631
Opcode Fuzzy Hash: f6f03e0461fee75aaec25282b1f81f24b923019eba341128af5dd98f7f0fb047
Instruction Fuzzy Hash: 7C31C330A55A0CEFEB309F14CC65BE837E6EB04393F5840D2BE1A971E1C7B099489B49

Function 00B2AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00B2ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00B2AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00B2AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00B2ACC6

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 802e30bf377827b4f7659305fc257140a20c4502d62d59bc24bc2d00a0398cb2
Instruction ID: 52a504cadbb3a0e2443b72275664cc9d1384246e3c8f991d975c8b5490bbb94b
Opcode Fuzzy Hash: 802e30bf377827b4f7659305fc257140a20c4502d62d59bc24bc2d00a0398cb2
Instruction Fuzzy Hash: 1B311630A04328AFFF258B64EC047FA7BEAEB89310F04439AE489531D1C37899858752

Function 00B57674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00B5769A
GetWindowRect.USER32(?,?), ref: 00B57710
PtInRect.USER32(?,?,00B58B89), ref: 00B57720
MessageBeep.USER32(00000000), ref: 00B5778C

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 0a61ba0f5b3024b1f1cea731b28430b33b56f4b22740e32ab7fd636cb38ab23c
Instruction ID: 5a557704c57bce09ec912bc1372745cd14143a087a3f6bfa7ebf8e079b2e8942
Opcode Fuzzy Hash: 0a61ba0f5b3024b1f1cea731b28430b33b56f4b22740e32ab7fd636cb38ab23c
Instruction Fuzzy Hash: 45418A347492159FCB02CF58F894FA97BF5FB49302F1480E9E8249B261CB30AD4ACB90

Function 00B516DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00B516EB

Part of subcall function 00B23A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B23A57
Part of subcall function 00B23A3D: GetCurrentThreadId.KERNEL32 ref: 00B23A5E
Part of subcall function 00B23A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B225B3), ref: 00B23A65

GetCaretPos.USER32(?), ref: 00B516FF
ClientToScreen.USER32(00000000,?), ref: 00B5174C
GetForegroundWindow.USER32 ref: 00B51752

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: f5b839122782036cff3f3b6467faceafd968c6ce675bd3307bcfe8b73951300e
Instruction ID: 2d3152da1c19af85039ee6dbae8326be99a760906f43138854bcd2ba737ee89e
Opcode Fuzzy Hash: f5b839122782036cff3f3b6467faceafd968c6ce675bd3307bcfe8b73951300e
Instruction Fuzzy Hash: 7E315271D00249AFC700EFA9C981EAEBBF9EF48304B5180AEE415E7211DB35DE45CBA0

Function 00B2DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00AC7620: _wcslen.LIBCMT ref: 00AC7625

_wcslen.LIBCMT ref: 00B2DFCB
_wcslen.LIBCMT ref: 00B2DFE2
_wcslen.LIBCMT ref: 00B2E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00B2E018

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 8fd3cf9d705b2e874e19833d31ddb5c4a9b33898de60de81bff1773134855607
Instruction ID: ed2ea4082202744f7b60c9658e5a6dbeeea9a33b03bb1932b6421894274baed2
Opcode Fuzzy Hash: 8fd3cf9d705b2e874e19833d31ddb5c4a9b33898de60de81bff1773134855607
Instruction Fuzzy Hash: 9A21A671900224AFCB109FA5DA82B6EB7F8EF45750F1440A5E805BB245D6709E418BA1

Function 00B2D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00B2D501
Process32FirstW.KERNEL32(00000000,?), ref: 00B2D50F
Process32NextW.KERNEL32(00000000,?), ref: 00B2D52F
CloseHandle.KERNEL32(00000000), ref: 00B2D5DC

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: dd05ec62c8e98e840a528086ea55e3b67ffdf3347c7cd22f9d67df99b1da04ab
Instruction ID: a4ccbf81314089487f40ed5f281552e03637e40e51bc7c2a3d9ffd922079af3d
Opcode Fuzzy Hash: dd05ec62c8e98e840a528086ea55e3b67ffdf3347c7cd22f9d67df99b1da04ab
Instruction Fuzzy Hash: 6F319C710083009FD300EF64D885FAFBBE8EFA9354F50096DF586871A1EB719948CBA2

Function 00B58FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AD9BB2

GetCursorPos.USER32(?), ref: 00B59001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00B17711,?,?,?,?,?), ref: 00B59016
GetCursorPos.USER32(?), ref: 00B5905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00B17711,?,?,?), ref: 00B59094

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: fd50ee3f96e9f53fbb81aefc26a9259f4bce88d8a21155a4321dd5e3f0e5994a
Instruction ID: 98446ef00bd2bd0d8c504f1481aa1b5c26e7922b98f3d599e24f7e8a39266aeb
Opcode Fuzzy Hash: fd50ee3f96e9f53fbb81aefc26a9259f4bce88d8a21155a4321dd5e3f0e5994a
Instruction Fuzzy Hash: F8219F35600118EFCB258F98CC99FEB7BFAEB49352F1848E5F905472A1D7319950EB60

Function 00B2D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00B5CB68), ref: 00B2D2FB
GetLastError.KERNEL32 ref: 00B2D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B2D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00B5CB68), ref: 00B2D376

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 5a4f32f9210ad23bfbe47bcf5f69eef1f23424b48c3a38fd5a9c4858acc15323
Instruction ID: a0c9b24b228ffb3f94a5c31d5a59ef996a860e5abd942f21acad72fe7c22f0ee
Opcode Fuzzy Hash: 5a4f32f9210ad23bfbe47bcf5f69eef1f23424b48c3a38fd5a9c4858acc15323
Instruction Fuzzy Hash: 8621A1705083119F8700DF28D985AAE7BE4EE5A324F104A9DF499C72A1DB31DD4ACB97

Function 00B21571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B21014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B2102A
Part of subcall function 00B21014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B21036
Part of subcall function 00B21014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B21045
Part of subcall function 00B21014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B2104C
Part of subcall function 00B21014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B21062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00B215BE
_memcmp.LIBVCRUNTIME ref: 00B215E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B21617
HeapFree.KERNEL32(00000000), ref: 00B2161E

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: bb948cab7036c89b743d6e685903096e0a87cf1f26dcc93df3a88e2fd69e8f08
Instruction ID: 0adf4be4c5185e1fa709f83056143c47071394d300d8436dd5a8bdc8e4c52dd2
Opcode Fuzzy Hash: bb948cab7036c89b743d6e685903096e0a87cf1f26dcc93df3a88e2fd69e8f08
Instruction Fuzzy Hash: FA219031E00219EFDF00DFA8D945BEEB7F9EF64355F184899E445AB241E770AA05CB50

Function 00B52782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00B5280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B52824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B52832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00B52840

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 813cba7b57cec69fe5ea6e0e41a9ce7958140d52a839eac510322b723ca8660d
Instruction ID: 9cb0745c6684df32c753ecd454c0b4ede856bf229d2bca183d0be59fb3b08426
Opcode Fuzzy Hash: 813cba7b57cec69fe5ea6e0e41a9ce7958140d52a839eac510322b723ca8660d
Instruction Fuzzy Hash: 0A21F131206210AFD715DB24C845FAA7B96EF4A325F1481D8F8268B2E2CB71FC86C7D0

Function 00B278F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B28D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00B2790A,?,000000FF,?,00B28754,00000000,?,0000001C,?,?), ref: 00B28D8C
Part of subcall function 00B28D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00B28DB2
Part of subcall function 00B28D7D: lstrcmpiW.KERNEL32(00000000,?,00B2790A,?,000000FF,?,00B28754,00000000,?,0000001C,?,?), ref: 00B28DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00B28754,00000000,?,0000001C,?,?,00000000), ref: 00B27923
lstrcpyW.KERNEL32(00000000,?), ref: 00B27949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00B28754,00000000,?,0000001C,?,?,00000000), ref: 00B27984

Strings

cdecl, xrefs: 00B2797B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 0b401dca5ee7a4c27ebe80aac66e00e2844f11a464a4e992abbc35bde42e7446
Instruction ID: bdd1c9d14eb5b30b9ddcabc72c76e07b30f676a1d4ef6448f7c54303b0e95bbe
Opcode Fuzzy Hash: 0b401dca5ee7a4c27ebe80aac66e00e2844f11a464a4e992abbc35bde42e7446
Instruction Fuzzy Hash: 6311B13A200312AFCB159F34E845E7A77E9EF85790B50406AE94ACB3A4EF319851C7A5

Function 00B57CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00B57D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00B57D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00B57D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00B3B7AD,00000000), ref: 00B57D6B

Part of subcall function 00AD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AD9BB2

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 3af9dc94a9942c096dcf541fb8ab1b2247d939add0243236b607f98b4d137a80
Instruction ID: faa4c34a1a46320475accbaf7dc23ec9894e469c35226df84fb55df59b006e3b
Opcode Fuzzy Hash: 3af9dc94a9942c096dcf541fb8ab1b2247d939add0243236b607f98b4d137a80
Instruction Fuzzy Hash: 4B11FD72204615AFCB118F28EC04BAA3BE5EF45362B1187A4FC39C72F0EB308915DB40

Function 00B55660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00B556BB
_wcslen.LIBCMT ref: 00B556CD
_wcslen.LIBCMT ref: 00B556D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B55816

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: c61d737498b65ab3fa60dd6f806cba5f42f03ec100d934925e33d28b1105f58d
Instruction ID: 28dfe3eb8e49ff740889aa3843d63aba0a67e1c6c779d02297ff7fe47e53f9f2
Opcode Fuzzy Hash: c61d737498b65ab3fa60dd6f806cba5f42f03ec100d934925e33d28b1105f58d
Instruction Fuzzy Hash: E911AF7160060996DB309BA58CD5BEE77FCEF10763F1040E6FD1596181EB709A88CF60

Function 00AF1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21f3c8ba81954d65258b9d6f3255ef9dd5eff82f815367d530adc28e7d7d284
Instruction ID: 84919da61e3e43396b87ee20bae61b69c8fd97e8589fc1198ea241886d383e16
Opcode Fuzzy Hash: f21f3c8ba81954d65258b9d6f3255ef9dd5eff82f815367d530adc28e7d7d284
Instruction Fuzzy Hash: 46014BB2209A1EBEF62126F86CC1F776A6DDF813F8B341329F721A21D2DB608C005160

Function 00AD990E Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,?), ref: 00AD98D6
SetBkMode.GDI32(?,00000001), ref: 00AD98E9
GetStockObject.GDI32(00000005), ref: 00AD98F1
GetWindowLongW.USER32(?,000000EB), ref: 00AD9952

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ColorLongModeObjectStockTextWindow
String ID:
API String ID: 2960364272-0
Opcode ID: 6014f0fb7d635a839c977dbf8be819a81c9a16a9ef06272c33e0c4e98fb77f50
Instruction ID: 0d741172536efea995d9dd9eabeeb8e3cb8b96d3ee79fa46ea917abe6efbd712
Opcode Fuzzy Hash: 6014f0fb7d635a839c977dbf8be819a81c9a16a9ef06272c33e0c4e98fb77f50
Instruction Fuzzy Hash: F01148311467909FDB128F24EC75AEB3FA5DB53312724419EE6839B2B2CA314941CB91

Function 00B21A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00B21A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B21A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B21A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B21A8A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 79023211e6831a370e98774ae2942888f135c1fbe44545d6be1399accf77ed9d
Instruction ID: 0bdc8ddff3e5a6979c1facd220aaa153e7efcaafed04278ca9537c2bf7b726f7
Opcode Fuzzy Hash: 79023211e6831a370e98774ae2942888f135c1fbe44545d6be1399accf77ed9d
Instruction Fuzzy Hash: AE112A3A901229FFEB109FA8C985FADBBB8EB18750F200491E614B7290D6716E50DB94

Function 00B2E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B2E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00B2E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00B2E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00B2E24D

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 4e31f80008fcc054b27addee1af372e02ef11c152a50c33956ed6f87a5ee70c1
Instruction ID: 0960ae1ecdd41fa35ec6a270d72cb5d55d14961b7ed7df09b6e1b1cba7707024
Opcode Fuzzy Hash: 4e31f80008fcc054b27addee1af372e02ef11c152a50c33956ed6f87a5ee70c1
Instruction Fuzzy Hash: 5D110872904365FFC7019FADAD05A9E7FADEB45311F104696F929E3291DA70CD0087A0

Function 00AED1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00AECFF9,00000000,00000004,00000000), ref: 00AED218
GetLastError.KERNEL32 ref: 00AED224
__dosmaperr.LIBCMT ref: 00AED22B
ResumeThread.KERNEL32(00000000), ref: 00AED249

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: cc94d8e3d475bfa1d1c568ed37c584056ff1042ec41e28a9f680f11a789b908c
Instruction ID: 3fc37f4fdb457632e2920b50d185eb68e64a99e544d0268cc3176a295535ea9e
Opcode Fuzzy Hash: cc94d8e3d475bfa1d1c568ed37c584056ff1042ec41e28a9f680f11a789b908c
Instruction Fuzzy Hash: 8901D236805388BFDB116BA7DC09BEE7E69EF81731F104259FA25921D0DF718901C6A0

Function 00B59EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00AD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AD9BB2

GetClientRect.USER32(?,?), ref: 00B59F31
GetCursorPos.USER32(?), ref: 00B59F3B
ScreenToClient.USER32(?,?), ref: 00B59F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00B59F7A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 39fc8765901fab85e34ff38fdd282dbd1a74de72b0348cbfd65fe4d15de8f3ec
Instruction ID: 07b75400ca7688955239567154f9ab06d2803fdb61e7a6d4aa2aa5742b0e16b7
Opcode Fuzzy Hash: 39fc8765901fab85e34ff38fdd282dbd1a74de72b0348cbfd65fe4d15de8f3ec
Instruction Fuzzy Hash: 0C11363290031AEBDB00DFA8D885AEE7BB9EB05312F0004D1F911E3140D730BA86CBA1

Function 00AC600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00AC604C
GetStockObject.GDI32(00000011), ref: 00AC6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00AC606A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: e81f0b9bd0c60ba39adf8a29d89ab887b3387de8086270a052d1fba430e543f3
Instruction ID: d808b12966a64e78c76e69086fa110fc27cef78e366feb67be6dc32207bea81e
Opcode Fuzzy Hash: e81f0b9bd0c60ba39adf8a29d89ab887b3387de8086270a052d1fba430e543f3
Instruction Fuzzy Hash: 6F116172501609FFEF128F949C44FEA7F6AEF0D355F054115FA1462110DB329C60DB90

Function 00AE3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00AE3B56

Part of subcall function 00AE3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00AE3AD2
Part of subcall function 00AE3AA3: ___AdjustPointer.LIBCMT ref: 00AE3AED

_UnwindNestedFrames.LIBCMT ref: 00AE3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00AE3B7C
CallCatchBlock.LIBVCRUNTIME ref: 00AE3BA4

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: f5446f609d49a32e349395428396414e4669439adb599181a91241a59eb3b348
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 5701E933100189BBDF126F96CD46EEB7B6EEF98754F044054FE4896121C732E961DBA0

Function 00AF3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00AC13C6,00000000,00000000,?,00AF301A,00AC13C6,00000000,00000000,00000000,?,00AF328B,00000006,FlsSetValue), ref: 00AF30A5
GetLastError.KERNEL32(?,00AF301A,00AC13C6,00000000,00000000,00000000,?,00AF328B,00000006,FlsSetValue,00B62290,FlsSetValue,00000000,00000364,?,00AF2E46), ref: 00AF30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00AF301A,00AC13C6,00000000,00000000,00000000,?,00AF328B,00000006,FlsSetValue,00B62290,FlsSetValue,00000000), ref: 00AF30BF

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 6530de9e9462d67d3cfe575033a23d22bea926ab604ff1375e4674c423e6330a
Instruction ID: 83db732acb786ed4b87b9a7008f2fd97aeebc3451b77374d49ccd915f4ab9e7b
Opcode Fuzzy Hash: 6530de9e9462d67d3cfe575033a23d22bea926ab604ff1375e4674c423e6330a
Instruction Fuzzy Hash: 3301883371172AAFCF214BB9AC44A777B999F45BA1B210621FA05E7240DF21D941C6D0

Function 00B27464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00B2747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00B27497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00B274AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00B274CA

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 594d514f030b8f7d25dac102d0cdb92bf30a596060e9065bfcf1096a7afaa8c5
Instruction ID: c4f58b27a366e21c5d7698b65f2038a2c5a22b5328af28ff88bf7149e48943cb
Opcode Fuzzy Hash: 594d514f030b8f7d25dac102d0cdb92bf30a596060e9065bfcf1096a7afaa8c5
Instruction Fuzzy Hash: AB118EB12453209FE7209F14EC48F927FFCEB00B00F1085A9A62AD7251DB70E904DB95

Function 00B2B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00B2ACD3,?,00008000), ref: 00B2B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B2ACD3,?,00008000), ref: 00B2B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00B2ACD3,?,00008000), ref: 00B2B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B2ACD3,?,00008000), ref: 00B2B126

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: ae0a438fe62f25c54be3db140b0d2d6eca1ced8ce1c9085a8516763e7e24ecd2
Instruction ID: 6530c38758a766f3f4256adb0cb2e2cc819c80aeb8718bf40300d2396e5e9179
Opcode Fuzzy Hash: ae0a438fe62f25c54be3db140b0d2d6eca1ced8ce1c9085a8516763e7e24ecd2
Instruction Fuzzy Hash: 28112A31C01A39DBCF00AFA4E9A8AEEBFB8FB09712F1040C5D945B2141CF3055508B51

Function 00B57E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B57E33
ScreenToClient.USER32(?,?), ref: 00B57E4B
ScreenToClient.USER32(?,?), ref: 00B57E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B57E8A

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 8549af119427635be730a006c10fb2e4a0e89605c652ee4f3aaf21f5e93e26cf
Instruction ID: e3311f987003bdb8dbcd905abc8aae31057f4c2e06cbd738ee3ef67392977d12
Opcode Fuzzy Hash: 8549af119427635be730a006c10fb2e4a0e89605c652ee4f3aaf21f5e93e26cf
Instruction Fuzzy Hash: DE1144B9D0020AAFDB41CF98D884AEEBBF9FF08311F505096E915E3210D735AA55CF50

Function 00B22DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B22DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B22DD6
GetCurrentThreadId.KERNEL32 ref: 00B22DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00B22DE4

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: e6a3f8c4f8109f3da9a0edf231b327ca5261fbbc4452f7f32009dd744c5392da
Instruction ID: aaed0692648aeaaf5effca0ac27a4526dc8b5a6bfaa4ed4386d1a198ad17fcba
Opcode Fuzzy Hash: e6a3f8c4f8109f3da9a0edf231b327ca5261fbbc4452f7f32009dd744c5392da
Instruction Fuzzy Hash: B8E06D721013347BD7201B72AC0DFEB3EADEB42BA2F1000A5B509D30809AA48941C6B0

Function 00B58863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00AD9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AD9693
Part of subcall function 00AD9639: SelectObject.GDI32(?,00000000), ref: 00AD96A2
Part of subcall function 00AD9639: BeginPath.GDI32(?), ref: 00AD96B9
Part of subcall function 00AD9639: SelectObject.GDI32(?,00000000), ref: 00AD96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00B58887
LineTo.GDI32(?,?,?), ref: 00B58894
EndPath.GDI32(?), ref: 00B588A4
StrokePath.GDI32(?), ref: 00B588B2

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: efd7e096117fc9da366c48ba8233258c2e4c1cf98af4253f69539ea4401ad196
Instruction ID: c27f253dd8380139c53fe57967a86d74a906ed26eb7d8caa89063d331ad34f58
Opcode Fuzzy Hash: efd7e096117fc9da366c48ba8233258c2e4c1cf98af4253f69539ea4401ad196
Instruction Fuzzy Hash: 42F03A36041359BADB126F94AD09FCA3F5AAF0A312F088081FA11660E2CB755511DBA5

Function 00AD98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00AD98CC
SetTextColor.GDI32(?,?), ref: 00AD98D6
SetBkMode.GDI32(?,00000001), ref: 00AD98E9
GetStockObject.GDI32(00000005), ref: 00AD98F1

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: c3cc800593fea2cddaaf5c121b65ffbd9ac792ae101d8dd502feff25e4af4076
Instruction ID: 2fdb9916a8c35c987354c0c65ed4ca008921f04052b025e6c235532b85112472
Opcode Fuzzy Hash: c3cc800593fea2cddaaf5c121b65ffbd9ac792ae101d8dd502feff25e4af4076
Instruction Fuzzy Hash: 6AE06531244740AEDB215B74BC19BD93F62EB11336F048259F6FA560E1CB7146409B10

Function 00B2162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00B21634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00B211D9), ref: 00B2163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00B211D9), ref: 00B21648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00B211D9), ref: 00B2164F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 8982d72becc5721fbaa542844ce00624d7c964775ec09872117f5d54642bffbe
Instruction ID: ddb2b10fce21d065aa3f8af99eb3e20b92f72b874c081749ff7126b6797f37f3
Opcode Fuzzy Hash: 8982d72becc5721fbaa542844ce00624d7c964775ec09872117f5d54642bffbe
Instruction Fuzzy Hash: 9CE08671602321EFD7301FA4AD0DB4A3FBDEF54B93F184888F249CA080DA344441C754

Function 00B1D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00B1D858
GetDC.USER32(00000000), ref: 00B1D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B1D882
ReleaseDC.USER32(?), ref: 00B1D8A3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: dc0a752b0868c6b09820321f504ca9ed4efdc0114e2d4349c9ad4e9187e6ddaa
Instruction ID: f6fcad05add8d47f3b92026b4a838e77d074afdb6dec983ecfa3228a4e373acd
Opcode Fuzzy Hash: dc0a752b0868c6b09820321f504ca9ed4efdc0114e2d4349c9ad4e9187e6ddaa
Instruction Fuzzy Hash: ADE09AB5800305DFDF419FA0D948B6DBFB6FB48712F148499E84AE7250CB385A41EF50

Function 00B1D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00B1D86C
GetDC.USER32(00000000), ref: 00B1D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B1D882
ReleaseDC.USER32(?), ref: 00B1D8A3

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: b671c7a27aaa486d885f77541ed9ebca2be54e62a2543a0e65486ceb18485c8f
Instruction ID: 769b763d6c40847dba48f25516969954e8002691df40ea03411920e6ebe418de
Opcode Fuzzy Hash: b671c7a27aaa486d885f77541ed9ebca2be54e62a2543a0e65486ceb18485c8f
Instruction Fuzzy Hash: 68E092B5800304EFCF51AFA0D908B6DBFB6FB48712B148489E94AE7250CB385A02EF50

Function 00B34D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC7620: _wcslen.LIBCMT ref: 00AC7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00B34ED4

Strings

LPT, xrefs: 00B34DFB
*, xrefs: 00B34E10

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 7f6a5b7cd6bd79af0c5ced94c62af3a9fde88222fa6794a01c0b316f72816076
Instruction ID: 10c73cb2566927ca77ef07fd2cd48e94896738f78f763371e7936797901ee094
Opcode Fuzzy Hash: 7f6a5b7cd6bd79af0c5ced94c62af3a9fde88222fa6794a01c0b316f72816076
Instruction Fuzzy Hash: 8F914D75A002549FCB14DF58C584EAABBF1EF49304F2980D9E80A9F362D735EE85CB91

Function 00AEE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00AEE30D

Strings

pow, xrefs: 00AEE2E5, 00AEE302

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 1c4e84b8480251b9eae511a25bd5c53bcb8d632683f9435340847996d16a38e0
Instruction ID: fcfcbd59f2ce4edf9ab471f169282ae70538fb52bbfa06632e5cf9f6ac5cf28e
Opcode Fuzzy Hash: 1c4e84b8480251b9eae511a25bd5c53bcb8d632683f9435340847996d16a38e0
Instruction Fuzzy Hash: 5B519A71A0C60A96DB11FB59CE013BE3BA4EB40740F704D69F1E6872E9EF358C819E42

Function 00ADE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00ADE1B1

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: cdba0aec2e7d3db2b89ec8264d56d958b30f89fec955788986eceaa4fb4d6cdd
Instruction ID: c6b2a05ca1aff211c26fa2e66ad8ea067d54fec15c9ca558ad42e22b30a6c6e3
Opcode Fuzzy Hash: cdba0aec2e7d3db2b89ec8264d56d958b30f89fec955788986eceaa4fb4d6cdd
Instruction Fuzzy Hash: 7951E475904246DFEF15EF68C481AFA7BE4EF55310FA4409AEC629B2D0DA34DD82C760

Function 00ADF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00ADF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00ADF2BB

Strings

@, xrefs: 00ADF2AF

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 658533fa80201e8ec127ff762f7ea0d50fe5e8e32adbd8a375207bf1f156d4f2
Instruction ID: 6dfe28a5dcf4e7d0f4d06d6bb7393d1f1b2466265fa76e272f9dae6117242855
Opcode Fuzzy Hash: 658533fa80201e8ec127ff762f7ea0d50fe5e8e32adbd8a375207bf1f156d4f2
Instruction Fuzzy Hash: 415154724087449BD320AF14DD86BAFBBF8FB84710F82884DF1D9521A5EF308569CB66

Function 00B45745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00B457E0
_wcslen.LIBCMT ref: 00B457EC

Strings

CALLARGARRAY, xrefs: 00B457E6, 00B457EB

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 0e43fe9cdda50a1f508eb92794604df0b62e21a4b6e1d8a538aae7c08b133a88
Instruction ID: 3a9f76f4cb4948145d684d7657eaba9fc2373ac0d02a240ac16350a4720f8800
Opcode Fuzzy Hash: 0e43fe9cdda50a1f508eb92794604df0b62e21a4b6e1d8a538aae7c08b133a88
Instruction Fuzzy Hash: CA41A271E006099FCB14DFA8C981DBEBBF5FF59314F1040A9E406A7252EB309E81DB90

Function 00B3D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B3D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00B3D13A

Strings

|, xrefs: 00B3D10B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: b5fdd99846074ed1ada4b8941bf59254d43951b813e2dea9d05854a9aa505b44
Instruction ID: b98e601a31a2e265c6c10ab77e7505ba743a23dd1e8dee5ee89cabc0c5543a0f
Opcode Fuzzy Hash: b5fdd99846074ed1ada4b8941bf59254d43951b813e2dea9d05854a9aa505b44
Instruction Fuzzy Hash: 1F311971D00209ABCF15EFA5DD85EEEBFB9FF08340F100059F815A6162EB31AA16CB60

Function 00B5356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00B53621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00B5365C

Strings

static, xrefs: 00B535BC

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 5298438ff78075fa7bfa3c7b0b1b21c5b66686e813dce23fa2e1989d60c131ab
Instruction ID: f7b7a7bab31911872773770b09b1c28ebed90a304fe2f565b55b3c014eee2d12
Opcode Fuzzy Hash: 5298438ff78075fa7bfa3c7b0b1b21c5b66686e813dce23fa2e1989d60c131ab
Instruction Fuzzy Hash: 54318D71100604AEDB109F28DC80FBB73E9FF98B61F10969DFCA597290DA30AD86D760

Function 00B54537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00B5461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B54634

Strings

', xrefs: 00B5458E

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 6d6e3163e9e4499fe63dbd2b55f25086ce55fd803191e36cd229a9d50204abf9
Instruction ID: 4cf0746e697f8279aaf57ce785202ed38dc9b20c36373997e940519e4b8dd9ef
Opcode Fuzzy Hash: 6d6e3163e9e4499fe63dbd2b55f25086ce55fd803191e36cd229a9d50204abf9
Instruction Fuzzy Hash: 3F311574A0120AAFDF14CFA9D990BDA7BF5FB19305F1044AAED04AB341E770A985CF90

Function 00B531EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00B5327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B53287

Strings

Combobox, xrefs: 00B53249

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: afba70887c0b1c48f2ceadb575c4786bae367ce8d2da5deb2b921030279ec2b0
Instruction ID: cc1e9b68b727d57509be3ed4e2de5229c7ca3782d0ee7e69f436d15b360b4f8b
Opcode Fuzzy Hash: afba70887c0b1c48f2ceadb575c4786bae367ce8d2da5deb2b921030279ec2b0
Instruction Fuzzy Hash: 0411B2713006087FEF219E54DC80FBB3BEAEB987A5F1041A9F918A7390D632DD559B60

Function 00B53710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00AC600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00AC604C
Part of subcall function 00AC600E: GetStockObject.GDI32(00000011), ref: 00AC6060
Part of subcall function 00AC600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AC606A

GetWindowRect.USER32(00000000,?), ref: 00B5377A
GetSysColor.USER32(00000012), ref: 00B53794

Strings

static, xrefs: 00B53757

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: d23f9fc34a882226d787cb79fc35422014130f41735d672f6da33daafa77ae27
Instruction ID: 192648a8e7ed671082705579b03db2d29d8b11e553767c95445b4066d6b15631
Opcode Fuzzy Hash: d23f9fc34a882226d787cb79fc35422014130f41735d672f6da33daafa77ae27
Instruction Fuzzy Hash: BA1159B2A10209AFDB00DFA8CC46EEA7BF8EB08345F004994FD55E3250EB34E8559B50

Function 00B3CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00B3CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00B3CDA6

Strings

<local>, xrefs: 00B3CD66

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: da908ea9aee910b89b3e5ed7189f3e1b698cf32acccc05646a79c5a3c0454bf4
Instruction ID: 9b6e082250b14b9079a88acf12bca3d6f3e8f26f3c53d5b6a3d9d979ac4ae0da
Opcode Fuzzy Hash: da908ea9aee910b89b3e5ed7189f3e1b698cf32acccc05646a79c5a3c0454bf4
Instruction Fuzzy Hash: BC11C6752056317AD7344BA68C85FE7BEEDEF127A4F2042B6B119A3090D7709840D7F0

Function 00B53429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00B534AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00B534BA

Strings

edit, xrefs: 00B5348F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: f963a2901f68aff7acded0143bb01b702dc2056d847a3f1a33ee5fcb8fe13810
Instruction ID: c5614039b63f6a2d1c3ddba279b80c2ca6a0219dd188d7b37cfb8542606b1695
Opcode Fuzzy Hash: f963a2901f68aff7acded0143bb01b702dc2056d847a3f1a33ee5fcb8fe13810
Instruction Fuzzy Hash: 64119071100204AFEB114E64DC80BAB3BEAEB04BB5F504794FD61933D0C771DC9A9750

Function 00B26C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00B26CB6
_wcslen.LIBCMT ref: 00B26CC2

Strings

STOP, xrefs: 00B26CBC, 00B26CC1

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 391f12fd24ffc46b313282388dc3bb1d7d9a8a3a6cfb8a426db0b0fe02438a4f
Instruction ID: 55105389997cea2c3aa2d4753a1e0d274166e2a10bec47b83e99b619acbbacb7
Opcode Fuzzy Hash: 391f12fd24ffc46b313282388dc3bb1d7d9a8a3a6cfb8a426db0b0fe02438a4f
Instruction Fuzzy Hash: 28012232A0053A8BCB20AFFDEC809BF37F9EB60750B0105B8E86693190EB31D900C750

Function 00B21CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

Part of subcall function 00B23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B23CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00B21D4C

Strings

ListBox, xrefs: 00B21D16
ComboBox, xrefs: 00B21CEB

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: bffacf88d3bdc5d80aabb34bf68ac23a9b07715c16877f17f703e912eff4d6fd
Instruction ID: 23779f9c31e4fd60f8331ad0bd10c20b84f4dba1a46276bc4e6a7c8496d8c4e1
Opcode Fuzzy Hash: bffacf88d3bdc5d80aabb34bf68ac23a9b07715c16877f17f703e912eff4d6fd
Instruction Fuzzy Hash: 7E01D875601228ABCB14EFA4ED55EFF77E8EB66390B040969F836672D1EA305908C760

Function 00B21BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

Part of subcall function 00B23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B23CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00B21C46

Strings

ListBox, xrefs: 00B21C10
ComboBox, xrefs: 00B21BE5

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 39437d0108b6e342b10fea6848a5c95c17edc0055843e5c205b79ac8357ed915
Instruction ID: 76ec73be5a7d3fe788e49dc1bb95fef446904acb812b64be5fd6ee19a089494e
Opcode Fuzzy Hash: 39437d0108b6e342b10fea6848a5c95c17edc0055843e5c205b79ac8357ed915
Instruction Fuzzy Hash: 4901F7756802186ACB14FB94DA55EFF77E8DB21340F100459A41A77291EA209F08C7B2

Function 00B21C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

Part of subcall function 00B23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B23CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00B21CC8

Strings

ListBox, xrefs: 00B21C94
ComboBox, xrefs: 00B21C69

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: bd6a09d0d248c42d28386dcef54418e59068fa7f4875b08b7bdc1806e6de78e6
Instruction ID: 9363ed32c4873b1e250c894a48a119d36b6f397fce7f90bbe818d736dab712d4
Opcode Fuzzy Hash: bd6a09d0d248c42d28386dcef54418e59068fa7f4875b08b7bdc1806e6de78e6
Instruction Fuzzy Hash: 8401D6756802286BCB14FBA4DB55FFF77E8DB21740F140469B80A77291EA209F18C7B2

Function 00B21D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC9CB3: _wcslen.LIBCMT ref: 00AC9CBD

Part of subcall function 00B23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B23CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00B21DD3

Strings

ListBox, xrefs: 00B21DA0
ComboBox, xrefs: 00B21D75

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 221bd447313010e80e2bfc9d28fd3c383fcd08886735eac484002333173a4a62
Instruction ID: 8b5a6fb06f42102cbaf2b56451340df616319c29e20070f9aa7570ddee4a1349
Opcode Fuzzy Hash: 221bd447313010e80e2bfc9d28fd3c383fcd08886735eac484002333173a4a62
Instruction Fuzzy Hash: ECF02D71B41328AAC714FBA4DD95FFF77F8EB11380F040D69F426632D1DA6059088360

Function 00B4747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B47493
_wcslen.LIBCMT ref: 00B474B9

Strings

3, 3, 16, 1, xrefs: 00B47483

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 6002e741c84018e204f67c464ba04a966e336fbf50a58bd6cf1529847f7fc968
Instruction ID: a52dd73065df2e7417241e5567a7fa4000ea77f82c1d75d98fa4e71cea8faf07
Opcode Fuzzy Hash: 6002e741c84018e204f67c464ba04a966e336fbf50a58bd6cf1529847f7fc968
Instruction Fuzzy Hash: 8DE02B02254260109231227A9DC197F57CDCFCD75071018ABF981D2367EF94CE92E3F1

Function 00B20B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00B20B23

Strings

AutoIt, xrefs: 00B20B17
Error allocating memory., xrefs: 00B20B1C

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 806129eefb0024f53df45b1283e93628eaf4051a96c6a45a2a493c0ff09c6fa7
Instruction ID: c1fbb287174395f67029e2acaddbdbfdc6eb78332ed10165d86c6929164a9250
Opcode Fuzzy Hash: 806129eefb0024f53df45b1283e93628eaf4051a96c6a45a2a493c0ff09c6fa7
Instruction Fuzzy Hash: 45E0D8322443182ED22036957D07F897FC5CF09F51F1004EBFB99555D38ED1285046E9

Function 00AE0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00ADF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00AE0D71,?,?,?,00AC100A), ref: 00ADF7CE

IsDebuggerPresent.KERNEL32(?,?,?,00AC100A), ref: 00AE0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00AC100A), ref: 00AE0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00AE0D7F

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: b34569c03cf7cf9dc288ea7a169e8d8a232774fb737aa601c438688f73a6247e
Instruction ID: 6dcfb1899be3f86b022f831055b8b54f0a6e43bc19b01fadd7a7e560caa3feb5
Opcode Fuzzy Hash: b34569c03cf7cf9dc288ea7a169e8d8a232774fb737aa601c438688f73a6247e
Instruction Fuzzy Hash: 6BE092702003428FD330AFBDD944B56BBE0AF00745F0049ADE882C7655EBF1E488CBA1

Function 00B33017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00B3302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00B33044

Strings

aut, xrefs: 00B33038

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 6f97ee86301cf448c458081795a68599b7f80a43daa11b068cae58c308380cee
Instruction ID: 05fc40f9987f3cffb958cea98f41aef9d560c5fc9de680accf85199bfb3b74d4
Opcode Fuzzy Hash: 6f97ee86301cf448c458081795a68599b7f80a43daa11b068cae58c308380cee
Instruction Fuzzy Hash: 77D05E725003286BDA20B7A4AC4EFCB3F6CDB04751F0002E1B655E30A1EEB19984CBD0

Function 00B1D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00B1D220

Strings

X64, xrefs: 00B1D2A8
%.3d, xrefs: 00B1D22B

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: b17beaa78de880433e4cf83385b320ed67c0811150c54bb54a6542d438137f27
Instruction ID: 2562a45108bf45879004b3dc24800cdef0c2a091213ae452ada46ce14b2905c8
Opcode Fuzzy Hash: b17beaa78de880433e4cf83385b320ed67c0811150c54bb54a6542d438137f27
Instruction Fuzzy Hash: 30D01271808218EDCB5097D0CCC5AFAB3FCFB19301FA084D3F81792040D634D588ABA1

Function 00B52322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B5232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00B5233F

Part of subcall function 00B2E97B: Sleep.KERNELBASE ref: 00B2E9F3

Strings

Shell_TrayWnd, xrefs: 00B52325

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 7dac7ea99ccf4c9f03fa8ca8d9fe6e17a0e2c715a91ab1931844011284072b17
Instruction ID: 5e144258cde9c2cfd99de63a9142d87f6b9d74ab8340ae03d04efe819ab6b834
Opcode Fuzzy Hash: 7dac7ea99ccf4c9f03fa8ca8d9fe6e17a0e2c715a91ab1931844011284072b17
Instruction Fuzzy Hash: 88D02236380310BBE264B370EC1FFC67E45AB00B01F0009827709AB0E0CDF0A800CB40

Function 00B52356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B5236C
PostMessageW.USER32(00000000), ref: 00B52373

Part of subcall function 00B2E97B: Sleep.KERNELBASE ref: 00B2E9F3

Strings

Shell_TrayWnd, xrefs: 00B52365

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: e4640eb63ee3f539c6b0fd27c8affc6f1c5253f7314a976f0c142bde1ef11285
Instruction ID: 25e4a82db0e06adb963dae5111cf3747cd09068a49c800cfee91e540cc22708e
Opcode Fuzzy Hash: e4640eb63ee3f539c6b0fd27c8affc6f1c5253f7314a976f0c142bde1ef11285
Instruction Fuzzy Hash: 34D0A9323803107AE264B370AC0FFC66A45AB04B01F4009827605AB0E0C9B0A800CA44

Function 00AFBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00AFBE93
GetLastError.KERNEL32 ref: 00AFBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00AFBEFC

Memory Dump Source

Source File: 00000000.00000002.2937639200.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.2937592649.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937749063.0000000000B82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937839363.0000000000B8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2937873256.0000000000B94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 96527dbf1bea10b2250971a7ae3d66264449bb92e4bc19d64760d70a3c5ff117
Instruction ID: 2e327a0f86541f1686992449331cbbae00b9f12da0c86253c2b30ce314b7c9df
Opcode Fuzzy Hash: 96527dbf1bea10b2250971a7ae3d66264449bb92e4bc19d64760d70a3c5ff117
Instruction Fuzzy Hash: 7641C13462020AAFCB218FE5CD44ABABBB5EF41320F244169FA599B1A1DB30CD00CB70

Source: Joe Sandbox View	IP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725888621&P2=404&P3=2&P4=j7KLYDrzn2Jgh%2f1VGwiFcC4zmt7bOzwV235loKiOZ%2bYLUtm3FHtAMyWOSr44lz2EBYlyTRZayutpDVtCke0ZYw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 25FUH1zhFqDNewMRI8FUZJSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DBSmEONwY8sORum&MD=Ln9lffu+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725888621&P2=404&P3=2&P4=j7KLYDrzn2Jgh%2f1VGwiFcC4zmt7bOzwV235loKiOZ%2bYLUtm3FHtAMyWOSr44lz2EBYlyTRZayutpDVtCke0ZYw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 25FUH1zhFqDNewMRI8FUZJSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=DBSmEONwY8sORum&MD=Ln9lffu+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.164
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.164
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.174

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\02a04e93-ddbc-44c5-acea-ca1ec557f7eb.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\23649bfe-ee63-41e0-bca4-b216ee02afa2.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\2989ca2d-066d-4fa8-861b-038d411f27a3.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5488f114-c52c-400d-b199-0e37a3a9bd60.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\67da2b36-3723-4efe-aba4-7cc22a07e8d4.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\82bf945a-8e90-4ddb-a8e2-63476fc5aaf9.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\99f71123-2dfe-496b-bc10-0baa77568163.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\9d116b98-d1fc-4473-be8f-1c86ac94cfc6.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\9ea6f7f0-a5ef-40ea-bb7c-fa7e7254c505.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\fb2321b2-9ed0-4cbe-8841-0f8a76aa1370.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D5BDD5-1D54.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D5BDD6-1E58.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\34f150ea-4d85-4e4b-b111-ec2d5d7c3c51.tmp

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre