Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1503857
MD5:	7a10fee1036074d25e1e08d620db8fb3
SHA1:	5d3e26f4b861fd5cab7b7800830ee82ed5c4242e
SHA256:	415b8003e03b51922260c6a3debf0a4b35e878bf04596733fa915fbde2c7694c
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 2720 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7A10FEE1036074D25E1E08D620DB8FB3)

msedge.exe (PID: 4960 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7184 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2032,i,8905798674714818459,6324943101716542901,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7200 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7484 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8632 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6892 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8644 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7072 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8724 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8744 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9048 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3088 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6164 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4216 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9460 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6036 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9468 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6036 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 10092 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2096,i,4050729052330294254,10800407992957941430,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8756 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8100 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=948 --field-trial-handle=2020,i,1714544722579944857,5177159478557245904,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7224 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2816 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2136,i,12101667890318184376,6573158094863645927,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Length: 326Content-Type: text/html; charset=us-asciiDate: Wed, 04 Sep 2024 01:36:01 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.2aac2d17.1725413761.9851898Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: *Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin: *

Source: protocols.json.11.dr	String found in binary or memory: https://.onedrive.com
Source: protocols.json.11.dr	String found in binary or memory: https://.onedrive.live.com
Source: file.exe, 00000000.00000002.2896034062.0000000000A81000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2896034062.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.11.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.11.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.11.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: a6c65ee9-fd5c-4656-8be2-ac45b62a88ed.tmp.12.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.11.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: a6c65ee9-fd5c-4656-8be2-ac45b62a88ed.tmp.12.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.11.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: file.exe, 00000000.00000002.2895574529.0000000000460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: protocols.json.11.dr	String found in binary or memory: https://sharepoint.com
Source: content_new.js.11.dr, content.js.11.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: a6c65ee9-fd5c-4656-8be2-ac45b62a88ed.tmp.12.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49796 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0051EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0051EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0051ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0051ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_0051EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0050AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0050AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00539576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00539576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1646741586.0000000000562000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7388abf9-7
Source: file.exe, 00000000.00000000.1646741586.0000000000562000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f1720ba9-f
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_56f20364-9
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_40fd56ce-9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0050D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0050D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00501201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00501201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0050E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0050E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00512046	0_2_00512046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A8060	0_2_004A8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00508298	0_2_00508298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DE4FF	0_2_004DE4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D676B	0_2_004D676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00534873	0_2_00534873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004ACAF0	0_2_004ACAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CCAA0	0_2_004CCAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004BCC39	0_2_004BCC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D6DD9	0_2_004D6DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004BB119	0_2_004BB119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A91C0	0_2_004A91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C1394	0_2_004C1394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C1706	0_2_004C1706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C781B	0_2_004C781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B997D	0_2_004B997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A7920	0_2_004A7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C19B0	0_2_004C19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C7A4A	0_2_004C7A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C1C77	0_2_004C1C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C7CA7	0_2_004C7CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052BE44	0_2_0052BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D9EEE	0_2_004D9EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004ABF40	0_2_004ABF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C1F32	0_2_004C1F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004BF9F2 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004C0A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@98/562@20/13

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005137B5 GetLastError,FormatMessageW,

0_2_005137B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005010BF AdjustTokenPrivileges,CloseHandle,		0_2_005010BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005016C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_005016C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005151CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_005151CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0052A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0052A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0051648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0051648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004A42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_004A42A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\5a95d419-b641-4a05-b8cd-b6d9fb538cb2.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.11.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 21%
Source: file.exe	Virustotal: Detection: 22%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2032,i,8905798674714818459,6324943101716542901,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6892 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7072 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3088 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4216 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6036 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6036 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2096,i,4050729052330294254,10800407992957941430,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=948 --field-trial-handle=2020,i,1714544722579944857,5177159478557245904,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2136,i,12101667890318184376,6573158094863645927,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2032,i,8905798674714818459,6324943101716542901,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6892 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7072 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3088 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4216 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6036 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6036 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2096,i,4050729052330294254,10800407992957941430,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=948 --field-trial-handle=2020,i,1714544722579944857,5177159478557245904,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2136,i,12101667890318184376,6573158094863645927,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004A42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004C0A76 push ecx; ret

0_2_004C0A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004BF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_004BF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00531C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00531C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-94911

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6548

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.3 %

Source: C:\Users\user\Desktop\file.exe TID: 4888

Thread sleep time: -65480s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6548 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0050DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005168EE FindFirstFileW,FindClose,	0_2_005168EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0051698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0051698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0050D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0050D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00519642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00519642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0051979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0051979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00519B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00519B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00515C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00515C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004A42DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-94857

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0051EAA2 BlockInput,

0_2_0051EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004D2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004D2622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004A42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004C4CE8 mov eax, dword ptr fs:[00000030h]

0_2_004C4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00500B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00500B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004D2622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004C083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C09D5 SetUnhandledExceptionFilter,	0_2_004C09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004C0C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00501201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004E2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_004E2BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0050B226 SendInput,keybd_event,

0_2_0050B226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005222DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_005222DA

Source: C:\Users\user\Desktop\file.exe

0_2_00500B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00501663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00501663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004C0698 cpuid

0_2_004C0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00518195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00518195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004FD27A GetUserNameW,

0_2_004FD27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004DBB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_004DBB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004A42DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00521204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00521204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00521806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00521806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
file.exe	21%	ReversingLabs
file.exe	23%	Virustotal	Browse
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
s-part-0014.t-0009.t-msedge.net	0%	Virustotal	Browse
chrome.cloudflare-dns.com	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
s-part-0029.t-0009.t-msedge.net	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://.onedrive.live.com	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://msn.com	0%	Virustotal		Browse
https://www.office.com/	0%	Virustotal		Browse
https://drive.google.com/	0%	Virustotal		Browse
https://www.google.com/chrome	0%	Virustotal		Browse
https://docs.google.com/	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://drive.google.com/	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Virustotal		Browse
https://www.google.com/favicon.ico	0%	Virustotal		Browse
https://.onedrive.live.com	1%	Virustotal		Browse
https://.onedrive.com	0%	Virustotal		Browse
https://.onedrive.com	0%	Avira URL Cloud	safe
https://sharepoint.com	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com	0%	Virustotal		Browse
https://sharepoint.com	0%	Virustotal		Browse
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true	false	0%, Virustotal, Browse	unknown
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.250.185.65	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
s-part-0029.t-0009.t-msedge.net	13.107.246.57	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.11.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://.onedrive.live.com	protocols.json.11.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content_new.js.11.dr, content.js.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://.onedrive.com	protocols.json.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	a6c65ee9-fd5c-4656-8be2-ac45b62a88ed.tmp.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sharepoint.com	protocols.json.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/passwordC:	file.exe, 00000000.00000002.2895574529.0000000000460000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.68	unknown	United States	15169	GOOGLEUS	false
23.200.0.42	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.42	s-part-0014.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.80.110	unknown	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.65.174	unknown	United States	15169	GOOGLEUS	false
13.107.246.57	s-part-0029.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1503857
Start date and time:	2024-09-04 03:34:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@98/562@20/13
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 42 Number of non-executed functions: 314
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.173.84, 13.107.42.16, 204.79.197.239, 13.107.21.239, 13.107.6.158, 2.19.126.145, 2.19.126.152, 142.250.185.163, 142.250.186.163, 2.23.209.182, 2.23.209.140, 2.23.209.133, 2.23.209.149, 20.223.35.26, 216.58.206.46, 199.232.214.172, 192.229.221.95, 142.250.185.138, 142.250.185.170, 142.250.186.106, 142.250.186.138, 142.250.181.234, 216.58.212.138, 142.250.186.170, 142.250.184.202, 142.250.185.106, 172.217.23.106, 142.250.184.234, 142.250.185.234, 142.250.185.202, 142.250.185.74, 216.58.206.42, 142.250.186.74, 2.19.126.163, 173.194.76.84, 142.250.80.67, 142.251.41.3, 142.250.65.195, 142.250.65.163, 142.251.32.99, 142.251.40.227, 142.251.35.163
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-0007.config.skype.com, edgeassetservice.azureedge.net, azur
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:35:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
02:35:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
02:35:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
02:35:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.200.0.42	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
13.107.246.42	https://protect-us.mimecast.com/s/FVibCzpzxLsxEMXAhgAOBC	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
	http://border-fd.smartertechnologies.com/	Get hash	malicious	Unknown	Browse	border-fd.smartertechnologies.com/
	https://protect-us.mimecast.com/s/4MrPCrkvgotDWxrNCzxa8p	Get hash	malicious	Unknown	Browse	www.mimecast.com/
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0014.t-0009.t-msedge.net	https://850705.formstack.com/forms/23outlook	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	malicious.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	PossiblePhishing.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	https://1drv.ms/o/s!Anj1aub9f0oSf85OHsWb-1KGYts?e=cSo5yQ	Get hash	malicious	Unknown	Browse	13.107.246.42
	https://demo.testfire.net/login.jsp	Get hash	malicious	Unknown	Browse	13.107.246.42
	http://www.porschecentreglasgow.co.uk	Get hash	malicious	Unknown	Browse	13.107.246.42
s-part-0029.t-0009.t-msedge.net	PO#86637.lzh	Get hash	malicious	FormBook	Browse	13.107.246.57
	malicious.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.57
	TBIG.exe	Get hash	malicious	AveMaria, UACMe, XRed	Browse	13.107.246.57
	1RGKUwuqi0.exe	Get hash	malicious	Remcos, PureLog Stealer, XRed	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	0m4MDxiRIE.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.57
chrome.cloudflare-dns.com	CODX.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://metaverifiedbadges.co/175261668994311/index.php?nick=YWZyaWNhbmJ1c2hjYW1wcw==&id=1526032324	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://swishmax.en.download.it/	Get hash	malicious	PureLog Stealer	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://static.rock.so/file/mAm512rA~/mAm512rA/2d214e336544c4cd0b1aaafcfffd0f29/HarringtonElectric.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://swishmax.en.download.it/	Get hash	malicious	PureLog Stealer	Browse	152.199.21.175
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.57
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.57
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	Unknown	Browse	173.222.108.211
	file.exe	Get hash	malicious	Unknown	Browse	23.55.235.170
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	23.59.250.83
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.38
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.83.5.113
	Pensacola Country Club.pdf	Get hash	malicious	Unknown	Browse	2.16.241.17
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
	https://xop.cjm.mybluehost.me/epubs/2022/AFI/shelves/22Q2-AFI-Motion-Shelf/	Get hash	malicious	Phisher	Browse	2.16.238.162
CLOUDFLARENETUS	CODX.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	http://www.conchtech.com/	Get hash	malicious	Unknown	Browse	188.114.96.3
	ATT.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://knowledgeable-expert.surge.sh/id.html/	Get hash	malicious	Unknown	Browse	104.26.5.15
	https://chainzip-intel-5qm.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://smruti-ranjan-sahoo-tech.github.io/NetflixClone	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://850705.formstack.com/forms/23outlook	Get hash	malicious	Unknown	Browse	104.18.10.212
	https://farehashcreative.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	172.66.44.71
	https://temp-site.5-xchange.us/	Get hash	malicious	HTMLPhisher	Browse	172.67.197.115
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://850705.formstack.com/forms/23outlook	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	http://xsdrt.hanslot88gacor.com/4fBcna16686hpgN1202wmiembuhsb14569WJUNFCAXDHLQZZY1707NPBU18900N17	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	Unknown	Browse	13.107.246.51
	https://swishmax.en.download.it/	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse	52.123.224.70
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	SecuriteInfo.com.Other.Malware-gen.18317.3179.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	94.245.104.56
EDGECASTUS	https://smruti-ranjan-sahoo-tech.github.io/NetflixClone	Get hash	malicious	HTMLPhisher	Browse	152.199.21.141
	https://www.dropbox.com/l/scl/AACzaw-9E1aatxpEZpO1dkWZ_aWUL6KS_-Q	Get hash	malicious	Unknown	Browse	152.195.15.58
	https://swishmax.en.download.it/	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse	152.195.19.97
	https://atpscan.global.hornetsecurity.com/index.php?atp_str=JXO3llrC97LYt_ypBDUoorYJESJf_lVgqG94Q8CbqZFSucjhJ8shDRR62UMpOfWQEisKw1UhsaXC2ei6wkJxZ78OKelMPUchf388beflwplmZ9bsAPTRZu8n2NfDqe2KOq7qiRxW9yxw4ZvRTonwJ07YfeXP0wQbvM2OFZWKje16pzGewsFyDVh5wRpEWnv0S9MgBr6GHEuMWbm1mAAXlTqLCgPJeXvAjfP8eHiPv4oozYP6pyTpRvkqdbjPLuTxQioCKIkn36kINOGd5zWy55BalBA1C-XppBzBxrZorCxNjXPTfp7EqG_ugHFutapq8UvczmG4Izo6I53rM9MZbHlXhpjq_iM6OiP6x3HRdgKt2jAlBNssK8G1	Get hash	malicious	Unknown	Browse	152.199.21.175
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	malicious.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	INVCherokeebrick.html	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://pensiuneaeladi.ro/cli	Get hash	malicious	HtmlDropper	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://www.greenprintlandscapes.com.au	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	http://www.conchtech.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	ATT.html	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	https://www.nyar-messenger.com/wp-content/87627428349820389/2FA.html	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	https://knowledgeable-expert.surge.sh/id.html/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	https://www.nyar-messenger.com/wp-content/87627428349820389/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	https://chainzip-intel-5qm.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.114.59.183
	http://www.swit.as/1e	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	https://sajid2004sk.github.io/shajid	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.114.59.183

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.612851621073999
Encrypted:	false
SSDEEP:	96:0q8NkC1fz1zrNSBQNv4B42eJkNc6SDS4S4SDSCI4a:/8NbJ1zYq26kNm
MD5:	7CDB181331C2DAA23E6C5449F1C44529
SHA1:	86C7D679F8D826D291D0634EAAE4B4AE4C04337C
SHA-256:	31FC81DF43050D126B578B76C1141AFBA30542289E52F2C1F976922D061B998C
SHA-512:	AB43B255D6814727ABB2D4ED241492C612C72667544477DF3EB5E6B12E76EFF7D22B84EC03CD49CA1A2C4736D1958ED999E4B22136E21875DC37227AFB607359
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\493ec5ff-d157-4c3f-901f-b0934646a2fa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.594190840754189
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afz1L0YRhGkHB+dddrxjvBiBJ/RX6aJkX9cKwlRnzQ+B0:Xq8NkC1fz1zr5BQNv4B3XDJkNcvzQ+q
MD5:	D6627FBB9209AB9A20B66BE232395968
SHA1:	D53B20A27B7F6CE8A41270B9C282FB9DF4977523
SHA-256:	4CDB16BF13F126782FA38C90890C2ECC74EC6B043C8E8671FF5F45603C48EB3B
SHA-512:	6660B73BBA6279D802CB9BDCF91EA8192E54BC00D5C7AA77007BE12B658B33F8FC4521F1855AF7964E9D23ECE6A38C1B47A8C5314E13FC451CCFCCD7AFDD4EBB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"policy":{"last_statistics_update":"13369887295010771"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\50a959df-31b9-41a3-97c9-a5a2f8b922f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20991
Entropy (8bit):	6.065685132723129
Encrypted:	false
SSDEEP:	384:utMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSOPSDJ5NZQBf6UzI8Z6Ix0FLx:iMGQ7FCYXGIgtDAWtJ4nq0J5NZq65dLD
MD5:	CE776698A586BFF46BA4C64B1A387C8E
SHA1:	B269AB7FD65A81342A23A491BD73DAE264FB4E09
SHA-256:	CF3321D0EF8FBF10B876AA2EFD387F2352A16658056C82164B2194D0254C6322
SHA-512:	7254CB59D6E04ACBAA46A83D4DE882703AB49982F42362C44193E794CB4CBD35C47708C5DFE6F02B13FEC401BD1664364F66E26798E51225EFA3084350EA365E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369887297426216","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5d62a90e-87f5-4650-b87a-b89177ea83c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71172
Entropy (8bit):	6.0743660503613235
Encrypted:	false
SSDEEP:	1536:iMGQ5XMBG+akT0qoO4CNrJGFFNiUVeKDZdxoDTv2Etg5qidLD:iMrJM88QXO0ZeK9I/2EkqALD
MD5:	3738C721388DD94A9DF16339CBAE9F82
SHA1:	5D882B5B3ABF94367D5B1294C0541FC95B06FC92
SHA-256:	70D1E22C803CD84CEA76B403445DAF0449245749D933A22AF223B5AB311D1FE9
SHA-512:	E72F1F0C0E2097D586257533BD53A7EFC666BCA17C2AC9A511C4A354082442561A4A7327C4467BD04A25A8E4B005698C01A44C91A2B8D08D29FC7BF12DA4E01B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369887297426216","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6484371c-c572-41da-ae6f-8a1df0137d09.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.594190840754189
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afz1L0YRhGkHB+dddrxjvBiBJ/RX6aJkX9cKwlRnzQ+B0:Xq8NkC1fz1zr5BQNv4B3XDJkNcvzQ+q
MD5:	D6627FBB9209AB9A20B66BE232395968
SHA1:	D53B20A27B7F6CE8A41270B9C282FB9DF4977523
SHA-256:	4CDB16BF13F126782FA38C90890C2ECC74EC6B043C8E8671FF5F45603C48EB3B
SHA-512:	6660B73BBA6279D802CB9BDCF91EA8192E54BC00D5C7AA77007BE12B658B33F8FC4521F1855AF7964E9D23ECE6A38C1B47A8C5314E13FC451CCFCCD7AFDD4EBB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"policy":{"last_statistics_update":"13369887295010771"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6fba6a4f-3202-415f-af4f-3c5911979e9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20991
Entropy (8bit):	6.065680577040398
Encrypted:	false
SSDEEP:	384:utMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSOP1DJ5NZQBf6UzI8Z6Ix0FLx:iMGQ7FCYXGIgtDAWtJ4nqhJ5NZq65dLD
MD5:	2A6C998D25179523BA83E542997D9F13
SHA1:	7CAB3A5113C538CB0040C3CA5972F3BC232DCA72
SHA-256:	09CF1EA58B6BC0E156F00867F2EA6E638DCF5E1F5B786AEEB55A8BF339A8403C
SHA-512:	95EBBD3309A5F894FF9EF949A2B37B648B0D0640E2B9F960690A4C432CD7D1CBBDB70030D8050B139C6A3523DE5A9412F9F423EC5B79FFB1D722FAC08FBE6BCB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369887297426216","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\804d53f6-b745-4033-91cc-bbcda44d2747.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.498422881701372
Encrypted:	false
SSDEEP:	96:0q8NkGS1fz1zr58rh/cI9URoDotoOaBQNv4B42eJkNc6SDS4S4SDSCI4a:/8NBSJ1zceoDUsq26kNm
MD5:	518148295B45DAF4D0867A7C377326D9
SHA1:	24A5E0971EF1410312D4F27F74953B5D5D23DD70
SHA-256:	F1EF42AA4B79ABA50F2061EC41BBA4BD00A16D87DEB8B03405119B519C8AB53E
SHA-512:	25BE629B1B173CBAE4253D2BABDA7433353E62A7E70DC004D121F104DF778356352A7D6C9E6BFD7AE03029852EF3F4EF349EE4CE4B2C8B8172C82546C24980FC
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0Cy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\85e43001-208f-4e60-b693-b1f5d594b693.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20991
Entropy (8bit):	6.0656642327397305
Encrypted:	false
SSDEEP:	384:utMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSOPeDJ5NZQBf6UzI8Z6Ix0FLx:iMGQ7FCYXGIgtDAWtJ4nqwJ5NZq65dLD
MD5:	8D37FCE70B04116862467900225106EE
SHA1:	019E5D7C01EA3B42529289BD2584693448EB0C9C
SHA-256:	E27F242D3FA1F54D7849DF4D2F4E72F23B68881E98AE8006F53DE9C09E3BFF69
SHA-512:	11802422A91E20C037DBDC6CC2FA5B3976A200662590B5999112ED7D01CC9262180ACB58F143E88451407A87179A9761626FBF2E763B1D29E0D07DF43C561F95
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369887297426216","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\86eda913-e369-409e-9cf4-ea31772d590a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71133
Entropy (8bit):	6.074288482115946
Encrypted:	false
SSDEEP:	1536:iMGQ5XMBGpakT0qoO4CNrJGFFNiUVeKDZdxoDTv2Etg5qidLD:iMrJM8lQXO0ZeK9I/2EkqALD
MD5:	C0B372B72CC76369261815EA8CB4E650
SHA1:	1AD96484F550504BC3EF8C63CB92560D6E6FE341
SHA-256:	A33AB19B47DAA3A005AF5E551CCE188E642ABFEA17148C5C7584D5307902F1DB
SHA-512:	3D5B7CB93D34EB3BCF70407317207E9587390C2C9324E97D7880C54A2A5538D8BFA9839B96B749B7CFDD5C1812B53CCE75D31296A90FC070E58CE602F3B02507
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369887297426216","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8d34bbeb-5c96-44cd-8bcc-4e25ad37cd58.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24343
Entropy (8bit):	6.057501779505967
Encrypted:	false
SSDEEP:	384:utMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NGOP1Dy+qdqVEEtgMQBf6UzI8Z6Ix0FLx:iMGQ7FCYXGIgtDAWtJ4nkhyZEtgMq65d
MD5:	92EB5DEDA56A9E2E8244B2A8CDDFFBB3
SHA1:	3B2B34D3D4102CDE33116B7054F1C5383C78C428
SHA-256:	4B9478F954A11B5F7D1527B30133B887F490426578AF745A382DE1AF34224DCA
SHA-512:	3C3C716485503A1A95F991AB1480F649B525CBD216D7540C10B6EEE662857C1A25B3073D0290538BB1D4F61C9A83ED28A2EBBBEDD0E9113D14168C0C5E153285
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369887297426216","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\4e51a93c-164c-4762-8f27-c300804b89e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D7B93E-1360.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.039853558536450895
Encrypted:	false
SSDEEP:	192:KyIUjLYiVWK+ggCSlKJXSAeNRX7rggK95zhqSNE8rT0RQcVNRDn8y08Tcm2RGOdB:/IUjjlROPuhhnUZTD08T2RGOD
MD5:	2492F47839994207B0DC266AFB25274F
SHA1:	D2396685C8E60E8ADCE6326612603D2200F2CC1A
SHA-256:	FE01B9FA7014FF88EE4CD3814723571BCAB72CF054A573E404EF2409C51B3090
SHA-512:	102F58DEF23942D2BAE39646A639E5D48FF318C26B20F4AF140FDDBDED3FCED68DE1156CC7816E82E9A45EDC9E99B8D4A92056E0A677CB4FC10BCCB93F6EB1FF
Malicious:	false
Preview:	...@..@...@.....C.].....@................_...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".bafoxq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...................................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....z..G."@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D7B93F-1C20.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4579755308828256
Encrypted:	false
SSDEEP:	3072:TYVNo9FHQSmmtzM/DAk4bT3dALifoX5XP/Pnh6g1HFcFhvy4rrH2IuqJ0sfCf6iT:EOFjmxnh6aHijt7M0DaHDvo6
MD5:	0F5BF3ACF8E5471DF5A41622916575FC
SHA1:	03448FAD803851FB3FA100D2C9001F3A3C55E298
SHA-256:	6F9F4594D5D670067E2E627092CA6E1827768B48D7FD523A5B29B8F589CC5D83
SHA-512:	C376D6BA3605FFCC28E829B0233D8C8E49ACD4CC7274A0853D008C0F6BACD2B47A33EFD0AD577BC7E0C5564529E97D266DF2A6CD1CDBDE340ED0458C72B39837
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xY..x=..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".bafoxq20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.147008152433693
Encrypted:	false
SSDEEP:	3:FiWWltlaJ2CFrp/UeHSRqOFhJXI2EyBl+BVP/Sh/JzvsTbfEVIH4WWCltl:o1adrp//yRqsx+BVsJDsvfWI17X
MD5:	7C86225F839FF1130CB22958659CE4D1
SHA1:	82161986DCFE557BDD7872194B391FBA8C1764ED
SHA-256:	2DA1A818B1F65E6CCE9C724D615A2BA408CC57E6F8B91E2365E14FCDF85476CE
SHA-512:	823FB3B4D0C28D7C45E825A6F5ED39DEE6E8F3A66E4202D985BFB34F6D0D96C9BA1A61624F680D038A64BA69318E07DE66256251E23ECFF374B948A990C39FF0
Malicious:	false
Preview:	sdPC.....................*....C.JI:...1"1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................1f63ed47-88a5-461a-bb61-1436280c6fa5............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1b6b9fb4-1f0b-4b29-bfe2-8da4307990fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.981750127469761
Encrypted:	false
SSDEEP:	96:st9qfkis1/b9nNhFiN8zxzxMs85eh6Cb7/x+6MhmuecmAeG1QM2MB/EJ:st92s/FiNkp2s88bV+FiAvPBMJ
MD5:	D101B17824D21D3A4A2538AE10A6BCE3
SHA1:	8F8DE6CBEFD2B587AAB31021F53A086FBDD1F477
SHA-256:	4E99F4097B974AE70A45D053E7D37A2FD7B9892DCF157F974AECF88DDA1C0259
SHA-512:	BDB6F9DB6F1476A564734FE87A3A9B51080CC8BA9B5F19EAFD946AFE529F38F25A8CF3AE62FF781A353E82EC80CA4A4EAA0BEAD6D14FBB069390BA3BC98E0033
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369887296420559","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369887296353669"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\6387e0fe-e835-47c0-b734-2fff14dcac78.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.566593054949996
Encrypted:	false
SSDEEP:	768:b9LuIjWPkGfys8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWffqGrw3pGtu7:b9LuIjWPkGfysu1ja33qDots
MD5:	8895A00F8FF1A498641E505927B8B1F2
SHA1:	2120459BABA5B23505EA95D4FEE13A77B8404DC1
SHA-256:	A19612C8A5945BE95E4A916B4B9F52BB998B63066A4691500E344AC5DCE791A8
SHA-512:	5FF7DA5967F7E4DC4AC5890E89A2962FA852246290FC824C9B88D99F212EDF7531E4DF3C19E8338326645EAB935B3CB1729B139E6607BD3FC221A6129A0DEFB2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369887295640816","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369887295640816","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\6a60fdb7-6e78-4c5c-8ce2-730aeaf5c90c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566703652854113
Encrypted:	false
SSDEEP:	768:b9LuIjWPkGf9s8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWffqGrwOpGtuu/:b9LuIjWPkGf9su1ja33qDrtH/
MD5:	A18BFDD84B9D1C0823F08F9AC4BD7160
SHA1:	E5E7FA8E52DCE1D50C718E6FE04235001E83BA30
SHA-256:	60DA1A73C6DC658207A95862DFC5471A131E6676356EB779F69060A20931F81C
SHA-512:	A95F5CB1E633DF6519FF440BCD2652F6B50C6DD0A3BD2F18381E6EB8FB21729A94FF7B919CBC8FEECBDF089443C84AF7F74F7824F5386FF793593A35C3B38233
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369887295640816","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369887295640816","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.3213919215559065
Encrypted:	false
SSDEEP:	192:AAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:zOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	C02B498BF52BADD3E535F938E5BFD30D
SHA1:	5A1956FDE2B4294CEAC82C4990582D43F5ECB7A3
SHA-256:	BA62AF2F242187F918FAF04D8E40EBAD3B542E1E3128F1D4B11A3476A5AFB8D2
SHA-512:	0DEEC93B6975941E0FBDFDC8AB1C6B3367644A5FC92F436DA949CEDC740C50ECE4AAA3FC3633AA782F2A0C158C54FB11DEEE09A9B9E7377EFBC7F06DEF884ED6
Malicious:	false
Preview:	...m.................DB_VERSION.1.h@..................QUERY_TIMESTAMP:arbitration_priority_list4...13369887301280816.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.114790065138265
Encrypted:	false
SSDEEP:	6:PBetUkB1wkn23oH+TcwtOEh1ZB2KLllBOEQ+q2Pwkn23oH+TcwtOEh1tIFUv:PBcTkfYebOEh1ZFLnBOx+vYfYebOEh1b
MD5:	804033F3CF358D9DE0FA45DFBD24DFB5
SHA1:	AB3FA25D816FB9159E5682736DBA4B31A7BDD6EE
SHA-256:	D989227BB66AADF6CCBE0523B7C69524CAEB78AA299D0F86ADD04599C167B82B
SHA-512:	7E5A3D555FC130A0B0FF601675AC577D12DFC23D1CA6AC61FB5FE67A98D0A320C152D229F5C17612A7D5D48797536A07C7628C588BCBE46DBD6AA895D37FAE85
Malicious:	false
Preview:	2024/09/03-21:35:00.432 21dc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/09/03-21:35:00.609 21dc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.0444220804391057
Encrypted:	false
SSDEEP:	6:/Fii2xSLCCkM/lEWJVZp33ra3MtaTCx/+kllD0SlR/lv:dYSOnEp/Zp33rMEaQz/Dh7
MD5:	7B19F3403E1D0946C7DC3BCBA4C18D61
SHA1:	53D41F71DF9943CB48D6F7B6A566FAB2911967C5
SHA-256:	A36DCD4A075F8763D513BD4A3A997BB6C1A2EE6CC232B700C388BEB586F944B5
SHA-512:	995DCFBFE3FE15242AA1BA1B9E207833492A6FF56C37E04A439357D4F4751B9FDDB59418AB2BC2E4FB400EA3FD7B87B6C09BC8897C49D66741070ADA06585F8F
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09558548249227306
Encrypted:	false
SSDEEP:	48:QWkdV4A3esHJV4XesrAIACh6NUeGKT3lWp4:pkdV4A33pV4X3rAbCh6NLGM3L
MD5:	03FD5EE0EDD19DE5A6A76BF214B96FD9
SHA1:	2A09DE5C086D4C66231CEAABD3BCA11BE171DDAF
SHA-256:	349FEDC3D614F0624CE20C2EB144BFEDBE2861EF760266EF7511D59B857EA784
SHA-512:	2E6751855868A960D38FC007671EBE60EFDC7B0EF6F5A06EF0D8A754DE9FE6A0CB8487128EBCB704AE71304660D1DC5FBB5746A006D78E225302AFE742706B29
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.2829740421178902
Encrypted:	false
SSDEEP:	192:nXyBX5npJZbtMsoqXyBX5npJZbtMsvX/XlZJZbtMAIXmXlZJZbtMAo7ZX8XxIJZg:iDJtnUDJtnlJtXhJtXa7Jtpof
MD5:	6E3394B3F2CF66E5F8820C80C55DBA7A
SHA1:	C2D68F7890987251289C19E70AAC37ED42BA2057
SHA-256:	D83CF0D6FDAF6B943CA1D965D0D56720A2CEE7D5A9B6DB388B5A5BE290200537
SHA-512:	C6BB1FC1A19E2B0A5CD219BC8B6EE47A2E2D343F4F135C98E640AC6A306B10F37C259EF8FD0B046EF74ECC075E3D13AE8A2C403E5E887D43DC9458300CC18480
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul3:Ls
MD5:	8EA432289A91884D9F9EE16989C13A6C
SHA1:	B6C08C2525E961463461C6FCA73A4D8AE671F57B
SHA-256:	E90C47B6ED97E5CB7679BFC0189BFA3FA917910F60D852114962C195568BCEA6
SHA-512:	6D19CDBCB382EEA87D3506D5F626FB76467FE2EF5E5434C28BD9BBE2F0DA2587190F01BC64EF8537698A90FA8EBA2D3FE1C6DCB2E75A7397F7C008A382ED1F09
Malicious:	false
Preview:	...........................................w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9138909867280645
Encrypted:	false
SSDEEP:	3:SBjEZsGEl:SBwZsvl
MD5:	EED2FAB41E6B0522C241F633E7B7E9A2
SHA1:	DC886A68755184E8F33E3712BC0ADE430EABC2DE
SHA-256:	ECF2A36CABE31760378E40961A2D65F3C7EA522C0DBC06637F302CA30FEBCF06
SHA-512:	7909551749B188CB5F5948F8F87EC59086A8DC02D24E4DB790A39BB847B3F70A03D8B73790DF5D6F637AAED706712C1BF4A1E924577B9286A2551B5CCF9A98F3
Malicious:	false
Preview:	(.....nkoy retne...........................v../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9138909867280645
Encrypted:	false
SSDEEP:	3:SBjEZsGEl:SBwZsvl
MD5:	EED2FAB41E6B0522C241F633E7B7E9A2
SHA1:	DC886A68755184E8F33E3712BC0ADE430EABC2DE
SHA-256:	ECF2A36CABE31760378E40961A2D65F3C7EA522C0DBC06637F302CA30FEBCF06
SHA-512:	7909551749B188CB5F5948F8F87EC59086A8DC02D24E4DB790A39BB847B3F70A03D8B73790DF5D6F637AAED706712C1BF4A1E924577B9286A2551B5CCF9A98F3
Malicious:	false
Preview:	(.....nkoy retne...........................v../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.8270049474208716
Encrypted:	false
SSDEEP:	3:2lP800EfZEl:2l0gfZM
MD5:	62D69A54855EE9CEF1CDD629E2E9E62D
SHA1:	5E962179F4AFBCCBD688C46BF35ADA04F92A8250
SHA-256:	BACDC7F0A0EDBC010FB2EC11D962081530B31139276A75E654EF6689D6C62605
SHA-512:	46CBA43D195D73466244E41EF14D2AFF973634F71060220B57DC11DE3CF82B8A4C1A006212BD046ED8B5315C91C6E822F8EA5E49540E5D9AB4CA323AFAB44D1A
Malicious:	false
Preview:	(......Coy retne........................C..v../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.8270049474208716
Encrypted:	false
SSDEEP:	3:2lP800EfZEl:2l0gfZM
MD5:	62D69A54855EE9CEF1CDD629E2E9E62D
SHA1:	5E962179F4AFBCCBD688C46BF35ADA04F92A8250
SHA-256:	BACDC7F0A0EDBC010FB2EC11D962081530B31139276A75E654EF6689D6C62605
SHA-512:	46CBA43D195D73466244E41EF14D2AFF973634F71060220B57DC11DE3CF82B8A4C1A006212BD046ED8B5315C91C6E822F8EA5E49540E5D9AB4CA323AFAB44D1A
Malicious:	false
Preview:	(......Coy retne........................C..v../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlK4t:Ls3K
MD5:	165C8DBEE162A5A4FC2D867D6CC3A770
SHA1:	F0D568063CD623A783933BC6C7B235A11D34E285
SHA-256:	ED7FD3011925C8D7AF88D805CA7F6AC940625E9D7FB1C7788A6D77BBAAC0E622
SHA-512:	ABB6187B8436B141FC817F96FEE9E13DD3550EFDCAC9C18CB16407A3B475780DFBD4F515D5B4E1237A77C47E7E1E19E06ED092839801555A2EAD3AD76EA9D515
Malicious:	false
Preview:	........................................$..w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354101170926633
Encrypted:	false
SSDEEP:	6144:9A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:9FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	5EA2DF5203B8797AC43C78ED3FDFF1CF
SHA1:	42F6C12D5E45D88C242BBDBC70628508D7807C3D
SHA-256:	7157CB37D238767B26DA4A78CC4400AB1E3778A4C04CC8DB79566A34639251E6
SHA-512:	038C8E66A87E95F6F713E9893A5FBEAD3AFE8D145C366A473B35676AD50B0E958A2CD275B5DC5151BF3C4A801F9172E4C8E9AF376ADFF6FB2254E10E9880F4C3
Malicious:	false
Preview:	...m.................DB_VERSION.1.i.Lq...............&QUERY_TIMESTAMP:domains_config_gz2...13369887301394286..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.210924049335655
Encrypted:	false
SSDEEP:	6:PBeP1wkn23oH+Tcwtj2WwnvB2KLllBY6N+q2Pwkn23oH+Tcwtj2WwnvIFUv:PBTfYebjxwnvFLnBYLvYfYebjxwnQFUv
MD5:	BB80BA9B6308B93D659F81B69B1CE0A1
SHA1:	0F50FDBAC563E2EBCFA76DE6FF52EB612CA020CB
SHA-256:	E7D41D208812CAA9C6FFBD8D20B35D1CFBA8B099E088FB69659B2C0927D5ED7B
SHA-512:	3C184972BC6F0EE4C672FF1F6F98284F2DC29B3CE4C0940178517979AAC2D9C643C90098EF309FB203BA865B145288AD6457F3D60D260AF1BBE6A7C0780B3861
Malicious:	false
Preview:	2024/09/03-21:35:00.608 21f8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/09/03-21:35:00.720 21f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.324603636903012
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RM:C1gAg1zfvk
MD5:	2A7E29787FB85CBE16CC99F54B237265
SHA1:	7AE5492976FE0556EB30D2635408F42E9C6F7112
SHA-256:	8A8E45988B2D32D901AACB55B11C43559F7C1C3C01CEE6205F253ED691EE081F
SHA-512:	2C7EF70BB7E3B092CD6CAC04765031E4F9432AEB8BEACEECCC58F02280AC7349D40F3766D7458E47E08B3E0E07C336FEF8CF62406F47BE802ACAD04733448618
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.242270496603856
Encrypted:	false
SSDEEP:	6:PBwgFB1wkn23oH+TcwttaVdg2KLllBMgq2Pwkn23oH+TcwttaPrqIFUv:PBzyfYebDLnBMgvYfYeb83FUv
MD5:	8C54FA17DC92785EF14946DDAC0E3406
SHA1:	646C013F3BB716017EC80B1C8BB7B3F653C578D3
SHA-256:	7AB507C323AE1E8BF04FCBC00D4D83713D657556269862D60651CC687EA2BACB
SHA-512:	8AE48894D0C3D770FCB19B705EAFD6BBCE93778935784A41687C45820728C6A660DC8718A41113F018342E4D009C6FCC863B8668FB35A3715E06D3D289D06AB1
Malicious:	false
Preview:	2024/09/03-21:34:55.706 1cb0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/09/03-21:34:55.718 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.219497675453203
Encrypted:	false
SSDEEP:	6:PBnUB1wkn23oH+Tcwtt6FB2KLllByFIq2Pwkn23oH+Tcwtt65IFUv:PBffYeb8FFLnBWIvYfYeb8WFUv
MD5:	587597EF7BA2CC61ECB855ECAC1E6DA9
SHA1:	F46C93CF77151847247B1C7014D7D76594DF7987
SHA-256:	49F59A9AF15E7E5AC15C9CFFC531F80612C9ED5EF13883FF8E49138A9C23094D
SHA-512:	540C2DE9D312E373E27A0F405C7BB8100014A1080C6B56EE686F26587B6B89EED6B252075C9ADE0242BAAA683EF33770352E79E6CFB6444B949E315BBD98D50F
Malicious:	false
Preview:	2024/09/03-21:34:55.723 1cb0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/09/03-21:34:55.736 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.18489444444268
Encrypted:	false
SSDEEP:	6:PByq1wkn23oH+TcwttYg2KLllBNu5QL+q2Pwkn23oH+TcwttNIFUv:PB6fYebJLnBES+vYfYeb0FUv
MD5:	EE756790CF539DC256EFC0A2024E974E
SHA1:	BD968AD10E0382E84728D350B88C319DF185302B
SHA-256:	68BFEA908DDE5072ED7D07CB305F87D708DDBB577618CBF9E822A027FF3957D6
SHA-512:	404F40A5FB8B8E4DF568CDFBB71D4EE91DFC3A4F0A3D465B03357E9A6F2C76A1231202FFD1A43A57F4C5D36305EA371B1165E2A8986239DBBECD3C016AFA8CD4
Malicious:	false
Preview:	2024/09/03-21:34:57.553 1cec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/09/03-21:34:57.564 1cec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlqcl:Ls3q
MD5:	1E508FA83D0530BAE29DF6F73CB8ACAC
SHA1:	4441460C53EB61D772D19C3D7E75A0C19D6F7E30
SHA-256:	CEEDC96F859921B5619D207C0C4F2AAC78C3C2134983B08EEA53DCCF2014F332
SHA-512:	A6C60B5592525A6516554920DD9DF911F118B857E43B24F9E5CD28F9AF6CAA695FEBCBBA17EAE227EAC1DC7AB81AAF927871EA7CB9D5CD47654C66047BD53175
Malicious:	false
Preview:	........................................K0.w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21743767966311625
Encrypted:	false
SSDEEP:	3:qnxllntFlljq7A/mhWJFuQ3yy7IOWUBwnVol/dweytllrE9SFcTp4AGbNCV9RUIn:qC75fOrSCl/d0Xi99pEYt
MD5:	90228CA58CD4BD46A0D67A342955DC4A
SHA1:	EC7205F79409AE0164DF0A11A403137FB664C2F7
SHA-256:	E6675EBDC5AA1DEB61D99E8E2CAB41CA67815DC7F7D8AEB593A2ED3E20CC4BE4
SHA-512:	BC43C4A051AE703371E0AD930B85DC9A1522311B7CF59DF0DA0A78CCF32A88E9C39584F16EA0036EDB22792B6DDACCC2F3350C4D9C9F8C8E7E605B053A0249E1
Malicious:	false
Preview:	.............i.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.22987373425976
Encrypted:	false
SSDEEP:	6:PBncPV3B1wkn23oH+TcwtRage8Y55HEZzXELIx2KLllBnYv4q2Pwkn23oH+TcwtV:PBnu6fYebRrcHEZrEkVLnBnI4vYfYebV
MD5:	05AE35D2A9C8F0BF80737FEA9BCA9FE4
SHA1:	4F7329217347D1054AE1F210C98EF2498C4A7500
SHA-256:	BFC1374EB9294793D03F00256095CD08096C0D1328C24EA385D86D897C424B30
SHA-512:	4B4CA159B440F36C306F4B66F633AF37F20A2812C33BACD958E6C9B40B30578F45707980C2EF72451DA780A52B29FE78967241F0950ABD8A90A1717F38ECD066
Malicious:	false
Preview:	2024/09/03-21:34:58.508 1cb0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/09/03-21:34:58.540 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.215635987805653
Encrypted:	false
SSDEEP:	6:PBQl1wkn23oH+TcwtRa2jM8B2KLllB5i+q2Pwkn23oH+TcwtRa2jMGIFUv:PB5fYebRjFLnB0+vYfYebREFUv
MD5:	3B918359F3D6AAE3DB30AF0ACF351D27
SHA1:	233FB149DD0A9CF7223B1FEB93FD60F9D57DCAA2
SHA-256:	4BD13F1624C2BE88B5E337531D0E957DE0C85EEC19A3FA652DE284614D1536D3
SHA-512:	F7425DD8A7679F20E5C635F389D213C64C137BDE13719D05D2C67A18E902523A554EDAF604AF7267C735D9B1BE85578083037C719D637EC88193AED4DA0AFF7A
Malicious:	false
Preview:	2024/09/03-21:34:57.276 1dec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/09/03-21:34:57.300 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\48e359bb-444f-40da-b9c9-69ca792ef645.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\73e35e03-4b15-48e6-aabb-ac592f3c489c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3b547.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7609720658439457
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkTU:uIEumQv8m1ccnvS6R
MD5:	F9800B26EC1B3019643ED4CEDEF8C6CC
SHA1:	21C503E4659EA391615DA2ACA5D856192CF2757F
SHA-256:	B3DA58C715B3D42DB06B13AE882A7960154C5F28247FE622FAD9DE9921004744
SHA-512:	E2682A9186BC91240B7DF7251261AA00F9C3634065903D5EFF744FE940732EC7185B4A58FAA125D45E7C1AB54C0029AEE58CF7B2BA8C26FD940A4868CF4A1095
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF2937c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\c00c1eb8-307c-4ad8-a0b1-4ae7e592d851.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\d29c9c0b-dd2a-4cf3-b119-030f30b3ca1d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\f6176985-a5bc-4fc8-be04-4e30b43ef072.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.89042451592505
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDHERW6JfYoR6oJbRHeHBYMKWKWMS7PMVKJq0nMb1KKtiVY:YHpo03h6ubIa4MS7PMVKJTnMRK3VY
MD5:	633DDD1B4920EC5BE074DBE9C025C0CA
SHA1:	544DEC5ED8BD3FBAB234940BEA45390B5CEF13D1
SHA-256:	8FCAE56F81D49DE83AC45BB8848E818C99462EEE03D017124E895D39630B3889
SHA-512:	CB89ABA6C2D59A7D520BD1BBDB85CBDF5CFBBE3DC9DFD02E06071F8597E3EB0D3B3BE3587AE58870B92127379A2C875A856F11B6792D4A68C5204837814549A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.972158018887927
Encrypted:	false
SSDEEP:	96:st9qfkis1/b9nNhFiN8zxzxMs85eh6Cb7/x+6MhmuecmAeGcM2MB/EJ:st92s/FiNkp2s88bV+FiATPBMJ
MD5:	8058ABC1FE9A96B544A7B5DAAE1DA848
SHA1:	53E3B07015E8D1F72A0FC8DC0B281671C1601106
SHA-256:	6450CDFAEC7F6B72E5C98DCBADC11B8266AD5936E71C30D9A354E86D0C6691C1
SHA-512:	0B48BAF71487470EFB8F4AB2CD4C5359A3BEA59A067ACC2538A15F2087CB3AA3EF41086D85D38A506AF01716A2D8C15C8B159DB4477F7737FC749E25B068EBE7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369887296420559","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369887296353669"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF32358.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.972158018887927
Encrypted:	false
SSDEEP:	96:st9qfkis1/b9nNhFiN8zxzxMs85eh6Cb7/x+6MhmuecmAeGcM2MB/EJ:st92s/FiNkp2s88bV+FiATPBMJ
MD5:	8058ABC1FE9A96B544A7B5DAAE1DA848
SHA1:	53E3B07015E8D1F72A0FC8DC0B281671C1601106
SHA-256:	6450CDFAEC7F6B72E5C98DCBADC11B8266AD5936E71C30D9A354E86D0C6691C1
SHA-512:	0B48BAF71487470EFB8F4AB2CD4C5359A3BEA59A067ACC2538A15F2087CB3AA3EF41086D85D38A506AF01716A2D8C15C8B159DB4477F7737FC749E25B068EBE7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369887296420559","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369887296353669"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF39878.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.972158018887927
Encrypted:	false
SSDEEP:	96:st9qfkis1/b9nNhFiN8zxzxMs85eh6Cb7/x+6MhmuecmAeGcM2MB/EJ:st92s/FiNkp2s88bV+FiATPBMJ
MD5:	8058ABC1FE9A96B544A7B5DAAE1DA848
SHA1:	53E3B07015E8D1F72A0FC8DC0B281671C1601106
SHA-256:	6450CDFAEC7F6B72E5C98DCBADC11B8266AD5936E71C30D9A354E86D0C6691C1
SHA-512:	0B48BAF71487470EFB8F4AB2CD4C5359A3BEA59A067ACC2538A15F2087CB3AA3EF41086D85D38A506AF01716A2D8C15C8B159DB4477F7737FC749E25B068EBE7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369887296420559","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369887296353669"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566703652854113
Encrypted:	false
SSDEEP:	768:b9LuIjWPkGf9s8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWffqGrwOpGtuu/:b9LuIjWPkGf9su1ja33qDrtH/
MD5:	A18BFDD84B9D1C0823F08F9AC4BD7160
SHA1:	E5E7FA8E52DCE1D50C718E6FE04235001E83BA30
SHA-256:	60DA1A73C6DC658207A95862DFC5471A131E6676356EB779F69060A20931F81C
SHA-512:	A95F5CB1E633DF6519FF440BCD2652F6B50C6DD0A3BD2F18381E6EB8FB21729A94FF7B919CBC8FEECBDF089443C84AF7F74F7824F5386FF793593A35C3B38233
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369887295640816","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369887295640816","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2f33f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566703652854113
Encrypted:	false
SSDEEP:	768:b9LuIjWPkGf9s8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWffqGrwOpGtuu/:b9LuIjWPkGf9su1ja33qDrtH/
MD5:	A18BFDD84B9D1C0823F08F9AC4BD7160
SHA1:	E5E7FA8E52DCE1D50C718E6FE04235001E83BA30
SHA-256:	60DA1A73C6DC658207A95862DFC5471A131E6676356EB779F69060A20931F81C
SHA-512:	A95F5CB1E633DF6519FF440BCD2652F6B50C6DD0A3BD2F18381E6EB8FB21729A94FF7B919CBC8FEECBDF089443C84AF7F74F7824F5386FF793593A35C3B38233
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369887295640816","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369887295640816","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.140497833283781
Encrypted:	false
SSDEEP:	6:PB0WhR1wkn23oH+TcwtSQM72KLllB0WkA+q2Pwkn23oH+TcwtSQMxIFUv:PB0WSfYeb0LnB0WkA+vYfYebrFUv
MD5:	6BCE33033118057D79D7BE1BBA81FDF5
SHA1:	AFEC510343D64236EE515B623CC27D4C4642B124
SHA-256:	3407E3E5C9C6D6E65D80AD1DF2C3EF81CC7049FFBB06F35D4735A562D6AE1CDB
SHA-512:	D3535456E81074A78FDA4FAF1A181164D35D6252F191F1346D3DA79B21518067897941B2A6D189D139FB7510E5B42BC095799CF4AD25A46B936275A42AF8EA68
Malicious:	false
Preview:	2024/09/03-21:35:13.289 1dec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/09/03-21:35:13.319 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.134606664106013
Encrypted:	false
SSDEEP:	6:PBgeM1wkn23oH+TcwtgUh2gr52KLllB5Qq2Pwkn23oH+TcwtgUh2ghZIFUv:PBgerfYeb3hHJLnBOvYfYeb3hHh2FUv
MD5:	078715117B3425D93BC35A554BCB14C0
SHA1:	044F29EED973FADD931E294CE2B7CF29CE329650
SHA-256:	ABA3B14D234E98FBC4EADADABA4A3F1A038D640E8D19DB932034793D4C7141C7
SHA-512:	8C939E0F3F368AE27EC1D2C817D4F2DC3EC5A8147BA820B29560C74D60E9EB151BEEB2232E1BAF6485D9B511B000DAB353FBABBCBA63BF75C1F20A6332008EEB
Malicious:	false
Preview:	2024/09/03-21:34:55.620 1cf4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/09/03-21:34:55.832 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul7L:Ls
MD5:	D2BCD00550B394955FFD49CFBA9A135A
SHA1:	AC4A720B51C73BB13880CA6A06843E8D1979DE95
SHA-256:	783DB0A4F05299EB1A01F69BAA13062C591FBBA47CA8475DD818FC9D6BFCD1F3
SHA-512:	2A4DE4B27E254ABCD7A3A69E57F7180B9906A07B24DA36DE6EDED5B0D84F899E998B31644F86D20141F41A05BF82C279FDB195A410051C90A8D2757577EB1211
Malicious:	false
Preview:	.........................................Xw../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:CS4aEF/PyTn:CT1FXMn
MD5:	48F67B27453DCD6B2E30759082F87EA3
SHA1:	D518C4601470C533E5E56B30BF3730A4B9B1B5F5
SHA-256:	A64817321B9A9F32EFBBDDED1CA2C4A7FB65AA65398BCA36DF08DECCAA65DB03
SHA-512:	4BCA8F5CA005218712F071CB461D9F26E54B76CF42A3E93575087B784F7B7837593DBBED3C9A141B100FDA9DBE99ECFB3558A53380D63CF163C5E712EF6DDC15
Malicious:	false
Preview:	(..._w..oy retne.........................Z.w../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:CS4aEF/PyTn:CT1FXMn
MD5:	48F67B27453DCD6B2E30759082F87EA3
SHA1:	D518C4601470C533E5E56B30BF3730A4B9B1B5F5
SHA-256:	A64817321B9A9F32EFBBDDED1CA2C4A7FB65AA65398BCA36DF08DECCAA65DB03
SHA-512:	4BCA8F5CA005218712F071CB461D9F26E54B76CF42A3E93575087B784F7B7837593DBBED3C9A141B100FDA9DBE99ECFB3558A53380D63CF163C5E712EF6DDC15
Malicious:	false
Preview:	(..._w..oy retne.........................Z.w../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:/wTEaSfa+:ogFT
MD5:	7E3426EAD2C32EC8EAC7E9ED1E159E0D
SHA1:	9A52B9621AF52359F2704BAC5418AA593C9DBFE7
SHA-256:	1B475512ED736D1CE8BA7592CF5B26DA98AF081D44A0945FB0744880351B185D
SHA-512:	096880F561D8B1C6638EEF1DA2F43004103F77B3935685073178AA115C7DC0E8BAF8A9B3F5F7EBC33A3CDCC0BBB892501ADDBD632D9627FEE7652F36C33A0974
Malicious:	false
Preview:	(...b.Tfoy retne.........................7.w../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:/wTEaSfa+:ogFT
MD5:	7E3426EAD2C32EC8EAC7E9ED1E159E0D
SHA1:	9A52B9621AF52359F2704BAC5418AA593C9DBFE7
SHA-256:	1B475512ED736D1CE8BA7592CF5B26DA98AF081D44A0945FB0744880351B185D
SHA-512:	096880F561D8B1C6638EEF1DA2F43004103F77B3935685073178AA115C7DC0E8BAF8A9B3F5F7EBC33A3CDCC0BBB892501ADDBD632D9627FEE7652F36C33A0974
Malicious:	false
Preview:	(...b.Tfoy retne.........................7.w../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl4iyaal:Ls348
MD5:	AD2FE436BFFA25BCD7F4E2748DC95F26
SHA1:	7CD33F90ADC92D1ACBA02A2784827FE0D131E1AC
SHA-256:	6F1B93F513909FC07F6A55921FF7CFA89BCA5C0EE356539FF1D08BB82FB68BAF
SHA-512:	604D73F33DB0C98F725CD28D4112F6E3D43A5570A702C873C663588D6DE0F504542DFDA97000423325B5121D9B7B32D4E1F9FDC8DD53399E97440D9A48286455
Malicious:	false
Preview:	..........................................w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlZJKt:Ls3bK
MD5:	73C8B2B629D444CAA42F46EBA05DC86F
SHA1:	F197A79A4C6C4B6F3848429A5501ACFB36A1235E
SHA-256:	B7D1908579933AE71B0CD2F03A44C0263DF998B4BFC956C7A3589E7216FF4148
SHA-512:	D8275B1BCD3C9D4C5C55460BECD3951410CA70347962771EB8982DB7286E90FA37E1FE86BD7161E74FDE98090B87DD5BB681869369CDF1740FB5DA4C4F77B6B8
Malicious:	false
Preview:	...........................................w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.2317033455106525
Encrypted:	false
SSDEEP:	12:PBWj9fYebqqBvFLnBni+vYfYebqqBQFUv:UfYebq8L1TYfYebqZ2
MD5:	5C5C13A7CDCB82FDC8721916DB50F8A0
SHA1:	EB0FB0B94DE307F3E834D6DD2D3B443B5F00A48B
SHA-256:	6EDF952CB36EC4FE12800555128EE47362B6786171885E4723D792C36AEC6D18
SHA-512:	69356A31516E65F9D6AE14CAEC91DFFE3574356063D2F598A30CD9DD65EFF7AE30A1C92A1981489975063262736DFCD50C3A6573CC4AD260E6EE101B36F49BD7
Malicious:	false
Preview:	2024/09/03-21:34:57.475 1dec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/09/03-21:34:58.019 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\37dbff2b-c3e0-466c-bfe2-02715e00ba21.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9c85cb96-bf29-4687-8b8c-0b4849550f52.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3b5d4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fd097bfd-4650-4d82-b181-60f80dbf6bfe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ff487588-9df9-4c54-9888-9fad6396981a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.211232678378033
Encrypted:	false
SSDEEP:	12:PB0WOayfYebqqB6LnB0WY+vYfYebqqBZFUv:Y9fYebqbL7YfYebqy2
MD5:	FEF9E73CFCCE3FBA7736B5C921BDA4A3
SHA1:	54ED06BA605C7D1F42CAF869E79F0902B2E3F6D1
SHA-256:	8853C865B7DC96EFF2B236AD4C8542415F846D998A2A9F214BC1F4EAC3DCA536
SHA-512:	66B94EE907666295E1BF46221CF1425134D946B3594E3A3358770CD232E855C65CA4D6CFA1EE6DDE7770AE501DB7C19A219BA477CD0CF0CE7929C109FA6A6DAC
Malicious:	false
Preview:	2024/09/03-21:35:13.348 1dec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/09/03-21:35:13.376 1dec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.265521890267601
Encrypted:	false
SSDEEP:	6:PBMzFB1wkn23oH+Tcwtkx2KLllBWR+q2Pwkn23oH+TcwtCIFUv:PBMzyfYebkVLnBWcvYfYebLFUv
MD5:	16DCB1065242C5BC9A4D8F2D15479F32
SHA1:	F57503A86A81B0E6C2C93182F2BF5DAEF4FB36BF
SHA-256:	04D33F668E61A8242CBD2E58D180AC1291DEE46EDEA25C095898284C62DFBF3E
SHA-512:	57F21FCE5250178768539B929BE1294D556BDB0E7B3FEB81250A91EF259FC8F2F36E1CAF7596742735EF167A5B1A605A464CA0F578D933C9115B361810F93666
Malicious:	false
Preview:	2024/09/03-21:34:55.718 1cf8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/09/03-21:34:55.734 1cf8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVY4Ktl:IiVYHX
MD5:	D7C3122370258E12A201243A88A1CBDD
SHA1:	D26405B5968A3D1DDB40DBB2A97823A79062F537
SHA-256:	DD1A7FB5DD4ABBC370C9326E21AD47EA8506A8EA6A60222616D20C61641C12B5
SHA-512:	96ED56B7B9867ACE489E84AE609B1EE756B8FF47BBEB45064F6C487527116C7397536CDF931EEE4D3C69EA54D581EAC6450B7876655C8FB8064718D030654C15
Malicious:	false
Preview:	VLnk.....?........#f.q]/................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0771656332749175
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOvSAE+WslKOMq+vVumYjNn66:e/2qOB1nxCkOvSAELyKOMq+vVumCp
MD5:	AEF98C31C2304D5162959A15CEF82599
SHA1:	AE61FFFD7067E3E5E27EE6A24805ED1F24E3817F
SHA-256:	E992A12270878E9598C551AA46F753F7B3A6052D982A6F1DEA8B4E4A91B9023E
SHA-512:	DF1C69189C492D4F316FF9C5F4BEC60F7ED29E0A24B0822C9B8DA989F1E0209B0827C166A24999ECB37A7B4F97273BEF98D42B1C404A0E411DD78DD6325F90A5
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\b7795d55-2edf-46a7-989e-8486f559d55e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\d576b94f-ecb0-456c-85df-af71938edea7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.972158018887927
Encrypted:	false
SSDEEP:	96:st9qfkis1/b9nNhFiN8zxzxMs85eh6Cb7/x+6MhmuecmAeGcM2MB/EJ:st92s/FiNkp2s88bV+FiATPBMJ
MD5:	8058ABC1FE9A96B544A7B5DAAE1DA848
SHA1:	53E3B07015E8D1F72A0FC8DC0B281671C1601106
SHA-256:	6450CDFAEC7F6B72E5C98DCBADC11B8266AD5936E71C30D9A354E86D0C6691C1
SHA-512:	0B48BAF71487470EFB8F4AB2CD4C5359A3BEA59A067ACC2538A15F2087CB3AA3EF41086D85D38A506AF01716A2D8C15C8B159DB4477F7737FC749E25B068EBE7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369887296420559","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369887296353669"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\dde5994c-b036-4746-9b86-cada38c88643.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.979429454895365
Encrypted:	false
SSDEEP:	96:st9qfkis1/b9nNhFiN8zxzxMs85eh6Cb7/x+6MhmuecmAeGXQM2MB/EJ:st92s/FiNkp2s88bV+FiAxPBMJ
MD5:	91E6BB0D386BE7657046E7F30BD5B7B0
SHA1:	4F5FD47101FB8BA5547180337EFC8662F4012E7D
SHA-256:	FCD21FA79F92450CB1537F9FEEEF3AC702ED0BDB9EED071565A1FE3188313506
SHA-512:	CD0C4815524341F4BBE093CC405AAE5793ADF5306306BB874BB056F288AE5CBF80618F1B508B331E68C07EE98B503702D2A8807B757FDB99544DCDE79FA5FAC3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369887296420559","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369887296353669"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\fc83a1a9-f86e-4224-a9b9-352822b4c65f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28109187076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/zGYJHlFll:7+/l/zGU
MD5:	562E1F26D8804199588329D148086A62
SHA1:	280DE22A18BAE1EECA3E3A3EAE957DED6299A23D
SHA-256:	D1680A3873315D6BF11E1C2283E035B6135599CD6BE96B5FE318A03AA7E1784D
SHA-512:	E1E19A5D411483F12198070AE57626499E12AEB25AD7F8DFEACC4FF648C3024BD04CC49F18C0F4FB41BB25042D4B9AD60602570C0BD25D9A3B7BA0E3E19FF25E
Malicious:	false
Preview:	.... .c......c}\................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.050021942291891254
Encrypted:	false
SSDEEP:	6:GLW0MotKPG4LW0MotKPeyL9X8hslotGLNl0ml/XoQDeX:afeG4bfeeKGEjVl/XoQ
MD5:	C4BB00FEEB83B60369AA7771662728EA
SHA1:	EB93481A990D9EDFAFBACAA255A23BB4978894B0
SHA-256:	E531C8DE82DE59895173BCAA3A99BDB2C5879621819F370BFB41256748599AE5
SHA-512:	A28BF063D9EC5C059CF570625E4B7C22FBE141CD3BF3084299BC049688E68915047B7384CD02D3C348BB70E289010B3D1BF15B96988707C6EE996A4308FEC221
Malicious:	false
Preview:	..-.....................+.rL......^vW.Rdi.Y0[&....-.....................+.rL......^vW.Rdi.Y0[&..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9949681253913234
Encrypted:	false
SSDEEP:	48:0zxglO+08cbX+Mn9VAKAFXX+P2VAKAFXX+RxOqVAKAFXX+dnUYVAKAFXX+mbc:cxE3pNsNNsXO5NskNsm4
MD5:	4DB1E64AC0256594F25048E5004C38CC
SHA1:	CB6B52246A6658F0834B2464EE37B9EB4FDEA94A
SHA-256:	BBD48D3FA8E8B560241E12678F238E3D12582896AE6D4049FEC567425C04B440
SHA-512:	DB8420AFF769F7B0853D861FD9D6664781D4226526D7011D71F9EDCEB41C8A7260480E8F527BA6AC4ED1C656CC375F1E028D0E934D6C570311555A15E200A95F
Malicious:	false
Preview:	7....-............^vW.RdKE.+g..'..........^vW.RdiY....k.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.491101016287002
Encrypted:	false
SSDEEP:	48:gB8TSBSqQclUP+HRHoxuIYjIYczcqkNMYjMYBy7AlkfAlkd3:W0qQaIYjIYczcbNMYjMYoYcYw3
MD5:	07D79214992C8FEC05A6EE5FE6D7A6C2
SHA1:	7CBAEE1AEE5A8BF9DCCE46B3148275AA52041282
SHA-256:	A8209B67DA7EDF5BF0FD72AB7E2974953CAFBB082691D0A038CAD3D98F01853B
SHA-512:	158EA8E63DD180941D01275AEBED3878F14DE2A4ED703B735E1ED5A18B85EEC13FEE4BB9F4A729CB3AD04A2F055084B6278A687FB65A46545065FA32555D04F6
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f....................................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFe

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.302772441325432
Encrypted:	false
SSDEEP:	6:PBpEM1wkn23oH+Tcwt0rl2KLllBpLq2Pwkn23oH+Tcwt0rK+IFUv:PBqrfYebeLnB1vYfYeb13FUv
MD5:	872C2AD7D3F94922C5784A2646787E1B
SHA1:	A0F929B72E0153A6ADA4CDE548F135B4B44F3BF0
SHA-256:	06ADC950CD7A4E2BACA34A8CE588D4F5A4672165C1CAC3E498F6882F2C6D47A5
SHA-512:	5222405ACE419647AC28F4DAFE049C6A681D5996418750EB03553EF23CE78F8501E491DC43798BA8149A5787AFE876BBADB7A602FB96CF8C04B465BD7AD9F5B9
Malicious:	false
Preview:	2024/09/03-21:34:56.789 1cf4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/09/03-21:34:56.799 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.958141412815535
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Wui+it/4JbZfPStub/RG0lbANqa:G0nYUtypD3RXi6FZfc25m
MD5:	FBC524D02048C176A0A5D1B8B752932A
SHA1:	294C48557549A4C978326D9B7969E293A024F157
SHA-256:	F3FC95AE128DB918FC126F15CD9D96618482BA6ACCC622AAA19B10CE80B15EA0
SHA-512:	9B6434442E11610B8B5DDA43AA56656599925C9C8F0A364DDB69D15B37A912D223EE600012468E0DB723CAF3546FFBDF56F085A0159EA7968BBACE894AAFF856
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....!....................3_.....n.b..................4_.........................37_.......`.................38_.....].$&.................39_.....4.9..................20_......R...................20_.......1..................19_......(...................18_.....:.=..................3_......W2..................4_.....)..>.................37_..........................38_.....h.#..................39_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.262754903868425
Encrypted:	false
SSDEEP:	6:PBpMuM1wkn23oH+Tcwt0rzs52KLllBpuROq2Pwkn23oH+Tcwt0rzAdIFUv:PBZrfYeb99LnBEROvYfYebyFUv
MD5:	111924EE5DB205471182301A107DD040
SHA1:	7F76D5CAFF1580BA02903490E6F277C16ABAD960
SHA-256:	A2FE7E231B56363A2C1600B89B0067C86415B3DAD95B28C8153CFEC3F5FB2301
SHA-512:	171360E9D30F884F44ADEE20EA42C2C35195F4465497A506ED8BDF05F1EE2BCE07C59D515D38894643CF9F9F8C734B59DC15FA7B89236AB9BCACE23A2B31BE81
Malicious:	false
Preview:	2024/09/03-21:34:56.713 1cf4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/09/03-21:34:56.786 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlQnyT/:Ls3QnM
MD5:	22A9A4C8A3A4DD492CC3F6716C0AAB76
SHA1:	598907AF0F9D09BFA530C27976C2E5A1A8AB228F
SHA-256:	0E63D51ABBB8B7CA2A321C5F9375DCAA3A5AEA16965A43800CB5F7B1FF1CE50E
SHA-512:	4A455DB75C08F591627B6DD87D1430678AEDFC081F49DCD68A9D5B977C3DB7D27F5F28005B5C470D6E5F61DBABB8A0C8856A3E33E4957711B77D2A6DA5CF74DA
Malicious:	false
Preview:	...........................................w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlhu:Ls3h
MD5:	317B9122A52890DAB8BC25C42C7E5396
SHA1:	9F3CBA0B5D1316A9A46290857DAB9B299C87AB4B
SHA-256:	86E7E601A93DBDD287A5A5E3006F8D2438743AB2904614DC4741DB2F578AB87D
SHA-512:	F612D38FD0B6FFD6DB1921050758457F00F840F1F198DCFA67649AD51A7C5C2FA5F103B3F9B1D4312DA6724F0F730EB6A9005960EF9465972AA95A4B2D81770A
Malicious:	false
Preview:	........................................U..w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.554038428242552
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtRR2e/cW02twXvmXjcyikR9JdXBuBuwBiaktonNhjrXRXaQQRZ:YuBqDPafz1L0YR+GgBzBiB6jrJbB0
MD5:	B8F862700BFA4B7DFEFD00315B5689C0
SHA1:	6AF3059DA52F95F5C6C14700A4BB609481CA864C
SHA-256:	CF08B3B7AA0494C25CD7E1AE9215F807EB5522FBFC9BCFCF2E8DFF3DC67DE692
SHA-512:	1009B80EF1182ECD16276CAFEAC5A8CD091D1FDAA2534E3DA9B7732A614539EFD692F0755CD434ED2358E7053F53987D34E87960750EAF0E19F65F3AB6359BCB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369887294938998","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725413694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28562.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.554038428242552
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtRR2e/cW02twXvmXjcyikR9JdXBuBuwBiaktonNhjrXRXaQQRZ:YuBqDPafz1L0YR+GgBzBiB6jrJbB0
MD5:	B8F862700BFA4B7DFEFD00315B5689C0
SHA1:	6AF3059DA52F95F5C6C14700A4BB609481CA864C
SHA-256:	CF08B3B7AA0494C25CD7E1AE9215F807EB5522FBFC9BCFCF2E8DFF3DC67DE692
SHA-512:	1009B80EF1182ECD16276CAFEAC5A8CD091D1FDAA2534E3DA9B7732A614539EFD692F0755CD434ED2358E7053F53987D34E87960750EAF0E19F65F3AB6359BCB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369887294938998","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725413694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28572.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.554038428242552
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtRR2e/cW02twXvmXjcyikR9JdXBuBuwBiaktonNhjrXRXaQQRZ:YuBqDPafz1L0YR+GgBzBiB6jrJbB0
MD5:	B8F862700BFA4B7DFEFD00315B5689C0
SHA1:	6AF3059DA52F95F5C6C14700A4BB609481CA864C
SHA-256:	CF08B3B7AA0494C25CD7E1AE9215F807EB5522FBFC9BCFCF2E8DFF3DC67DE692
SHA-512:	1009B80EF1182ECD16276CAFEAC5A8CD091D1FDAA2534E3DA9B7732A614539EFD692F0755CD434ED2358E7053F53987D34E87960750EAF0E19F65F3AB6359BCB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369887294938998","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725413694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF287c4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.554038428242552
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtRR2e/cW02twXvmXjcyikR9JdXBuBuwBiaktonNhjrXRXaQQRZ:YuBqDPafz1L0YR+GgBzBiB6jrJbB0
MD5:	B8F862700BFA4B7DFEFD00315B5689C0
SHA1:	6AF3059DA52F95F5C6C14700A4BB609481CA864C
SHA-256:	CF08B3B7AA0494C25CD7E1AE9215F807EB5522FBFC9BCFCF2E8DFF3DC67DE692
SHA-512:	1009B80EF1182ECD16276CAFEAC5A8CD091D1FDAA2534E3DA9B7732A614539EFD692F0755CD434ED2358E7053F53987D34E87960750EAF0E19F65F3AB6359BCB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369887294938998","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725413694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28802.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.554038428242552
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtRR2e/cW02twXvmXjcyikR9JdXBuBuwBiaktonNhjrXRXaQQRZ:YuBqDPafz1L0YR+GgBzBiB6jrJbB0
MD5:	B8F862700BFA4B7DFEFD00315B5689C0
SHA1:	6AF3059DA52F95F5C6C14700A4BB609481CA864C
SHA-256:	CF08B3B7AA0494C25CD7E1AE9215F807EB5522FBFC9BCFCF2E8DFF3DC67DE692
SHA-512:	1009B80EF1182ECD16276CAFEAC5A8CD091D1FDAA2534E3DA9B7732A614539EFD692F0755CD434ED2358E7053F53987D34E87960750EAF0E19F65F3AB6359BCB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369887294938998","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725413694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2af22.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.554038428242552
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtRR2e/cW02twXvmXjcyikR9JdXBuBuwBiaktonNhjrXRXaQQRZ:YuBqDPafz1L0YR+GgBzBiB6jrJbB0
MD5:	B8F862700BFA4B7DFEFD00315B5689C0
SHA1:	6AF3059DA52F95F5C6C14700A4BB609481CA864C
SHA-256:	CF08B3B7AA0494C25CD7E1AE9215F807EB5522FBFC9BCFCF2E8DFF3DC67DE692
SHA-512:	1009B80EF1182ECD16276CAFEAC5A8CD091D1FDAA2534E3DA9B7732A614539EFD692F0755CD434ED2358E7053F53987D34E87960750EAF0E19F65F3AB6359BCB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369887294938998","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725413694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2ead3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.554038428242552
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtRR2e/cW02twXvmXjcyikR9JdXBuBuwBiaktonNhjrXRXaQQRZ:YuBqDPafz1L0YR+GgBzBiB6jrJbB0
MD5:	B8F862700BFA4B7DFEFD00315B5689C0
SHA1:	6AF3059DA52F95F5C6C14700A4BB609481CA864C
SHA-256:	CF08B3B7AA0494C25CD7E1AE9215F807EB5522FBFC9BCFCF2E8DFF3DC67DE692
SHA-512:	1009B80EF1182ECD16276CAFEAC5A8CD091D1FDAA2534E3DA9B7732A614539EFD692F0755CD434ED2358E7053F53987D34E87960750EAF0E19F65F3AB6359BCB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369887294938998","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725413694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF33efe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.554038428242552
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtRR2e/cW02twXvmXjcyikR9JdXBuBuwBiaktonNhjrXRXaQQRZ:YuBqDPafz1L0YR+GgBzBiB6jrJbB0
MD5:	B8F862700BFA4B7DFEFD00315B5689C0
SHA1:	6AF3059DA52F95F5C6C14700A4BB609481CA864C
SHA-256:	CF08B3B7AA0494C25CD7E1AE9215F807EB5522FBFC9BCFCF2E8DFF3DC67DE692
SHA-512:	1009B80EF1182ECD16276CAFEAC5A8CD091D1FDAA2534E3DA9B7732A614539EFD692F0755CD434ED2358E7053F53987D34E87960750EAF0E19F65F3AB6359BCB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369887294938998","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725413694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF37149.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.554038428242552
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtRR2e/cW02twXvmXjcyikR9JdXBuBuwBiaktonNhjrXRXaQQRZ:YuBqDPafz1L0YR+GgBzBiB6jrJbB0
MD5:	B8F862700BFA4B7DFEFD00315B5689C0
SHA1:	6AF3059DA52F95F5C6C14700A4BB609481CA864C
SHA-256:	CF08B3B7AA0494C25CD7E1AE9215F807EB5522FBFC9BCFCF2E8DFF3DC67DE692
SHA-512:	1009B80EF1182ECD16276CAFEAC5A8CD091D1FDAA2534E3DA9B7732A614539EFD692F0755CD434ED2358E7053F53987D34E87960750EAF0E19F65F3AB6359BCB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369887294938998","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725413694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF39869.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.554038428242552
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtRR2e/cW02twXvmXjcyikR9JdXBuBuwBiaktonNhjrXRXaQQRZ:YuBqDPafz1L0YR+GgBzBiB6jrJbB0
MD5:	B8F862700BFA4B7DFEFD00315B5689C0
SHA1:	6AF3059DA52F95F5C6C14700A4BB609481CA864C
SHA-256:	CF08B3B7AA0494C25CD7E1AE9215F807EB5522FBFC9BCFCF2E8DFF3DC67DE692
SHA-512:	1009B80EF1182ECD16276CAFEAC5A8CD091D1FDAA2534E3DA9B7732A614539EFD692F0755CD434ED2358E7053F53987D34E87960750EAF0E19F65F3AB6359BCB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369887294938998","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725413694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3f87a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.554038428242552
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtRR2e/cW02twXvmXjcyikR9JdXBuBuwBiaktonNhjrXRXaQQRZ:YuBqDPafz1L0YR+GgBzBiB6jrJbB0
MD5:	B8F862700BFA4B7DFEFD00315B5689C0
SHA1:	6AF3059DA52F95F5C6C14700A4BB609481CA864C
SHA-256:	CF08B3B7AA0494C25CD7E1AE9215F807EB5522FBFC9BCFCF2E8DFF3DC67DE692
SHA-512:	1009B80EF1182ECD16276CAFEAC5A8CD091D1FDAA2534E3DA9B7732A614539EFD692F0755CD434ED2358E7053F53987D34E87960750EAF0E19F65F3AB6359BCB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369887294938998","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725413694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlQQl:Ls3H
MD5:	BBCBF38B6C93451DAF235ADC4FE30668
SHA1:	8F9776D823BB957115D204C5BE1BD23490C83813
SHA-256:	02E56B978809E5D02C1F25B3231EBC9B102CB9C3DBDE950144D926022341D12C
SHA-512:	0C06E1B1F8A35F549706EC35478FF63A7DC0ABB99B73A9EF97FEA22F832EE7015F0D32A2D409451B96C7270362BA0149C41151CF646D2B71EEFE73CE2AD412BA
Malicious:	false
Preview:	...........................................v../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\fe46a3e5-f444-4e37-8003-4406422b1aa1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.554038428242552
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtRR2e/cW02twXvmXjcyikR9JdXBuBuwBiaktonNhjrXRXaQQRZ:YuBqDPafz1L0YR+GgBzBiB6jrJbB0
MD5:	B8F862700BFA4B7DFEFD00315B5689C0
SHA1:	6AF3059DA52F95F5C6C14700A4BB609481CA864C
SHA-256:	CF08B3B7AA0494C25CD7E1AE9215F807EB5522FBFC9BCFCF2E8DFF3DC67DE692
SHA-512:	1009B80EF1182ECD16276CAFEAC5A8CD091D1FDAA2534E3DA9B7732A614539EFD692F0755CD434ED2358E7053F53987D34E87960750EAF0E19F65F3AB6359BCB
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADZyTs/XBgdR19bOiYUNIoxfefNxeF43oiyIqGY/NzgEgAAAAAOgAAAAAIAACAAAAAED2prYK6bBZIOs/57JMWdHtiYjmtNv4HACneYjRtTbjAAAACTqu/LFpXqLPJdfnwhDH2IWJDJBfLfvM+vC2BC1sQLDyFh7MIYw7OuV0auXVIP3jtAAAAAkAxUWE/hyRdbJPLUc2HvutkqF8wZvimcC7vAQzjcuzAZuXlS0FZud4RQ3LXf4UObheOUt0oGewVHbw0CyA78Sg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369887294938998","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725413694"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0304091e-209a-4197-af72-6ba96a6ccb4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.059314347515732
Encrypted:	false
SSDEEP:	384:GtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwXmG6vNTEN555LI0L:qMGQ7FCYXGIgtDAWtJ4nf6vNTUB
MD5:	36CC64B5E67C279BCA8AE4FA121F1DBE
SHA1:	9001E8D7854F11CA89248A471837F032C7CDD18B
SHA-256:	51C0A3AC7F053E575EA93013A888D6208A8C3EFF707B1F6088E964EAEE6099A4
SHA-512:	97373B6064F11DD861E77B18D34B83A7DD6DBC7CD029BCFD02B4D596E3E192873651B961002C93FFEB72A2BED11FDC930D6A2326BEBF773EBF4605EF8313F5E9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369887311449306","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0a765da6-bedf-4dfd-a58d-944ad3ffd213.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.832381839455223
Encrypted:	false
SSDEEP:	192:fsNwrR6eiRUJ/I1tQ5vcAW1dkN796qRAq1k8SPxVLZ7VTiB:fsNwmw/w+5vcAquN796q3QxVNZTiB
MD5:	19D1C7AB66E7C5A2348B7C686C1D8596
SHA1:	09C458674FAA70C0C01A2BEADF1D94344A68625A
SHA-256:	7EBC7C8A4DCF9013063D60E1E45D6C434B9C26F5494CE9B361054F4FF804668B
SHA-512:	2D9B010BE167E5350B13FB2CBE44FA9C549B1DFEB66CAD84F447CF95DCD58B91486ADF75DF45358E656BE65267000578DB50A82E2866DF27FCA9E400BBB4ED78
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1e093e81-9777-4b2a-8dfe-860ed2a66b82.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.805710682943955
Encrypted:	false
SSDEEP:	192:fsNArR6eiRU8/zQUkNC6qRAq1k8SPxVLZ7VTiQ:fsNAmD/0vNC6q3QxVNZTiQ
MD5:	D7804A185F58C7E1BC13014C6E7F737B
SHA1:	66B8B00950FF4A1340A836C0143222FA604A2AD0
SHA-256:	CF03C3164A16C20D45FE69717A6B9C2D7654D9A57BDE95BC86B89997AF790D28
SHA-512:	1D40CAEA3FE02E3BCE5F0DC4FC5FE66BB84E5458FB2A51EA284167162A68F1D5B739E8CA132A96DC622B9A9DA9DE814B4D6465993FA3FD2AECEFD133656152C1
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2bcc727b-c442-4503-887e-d22a692b9f9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\33ec54d3-9141-401d-88d2-a0e50997ab5d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.832394320955408
Encrypted:	false
SSDEEP:	192:fsNwrR6eiRUJ/I1tQ5vcAnyckN796qRAq1k8SPxVLZ7VTiB:fsNwmw/w+5vcAyXN796q3QxVNZTiB
MD5:	3E351CE143398BFB7BFD6E4D7A1410D0
SHA1:	3DE71A891CD2AB6EC735AD45CBC7D79991D57AD5
SHA-256:	AFF42032C0A2F5A2D16D050AEA401A01DB6C8E941F210032EB22D807D93C5B52
SHA-512:	82BC6B551B3D6337FECC1E9F6F65AA99B971237227E0CBE8DE6650F25A4466064998B24848EBED182F628979A3C22F089ED5E22D98945D9A60A46C7F69F6469E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\373da2eb-a908-4ad6-b30a-2e658d6b91c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.832381839455223
Encrypted:	false
SSDEEP:	192:fsNwrR6eiRUJ/I1tQ5vcAW1dkN796qRAq1k8SPxVLZ7VTiB:fsNwmw/w+5vcAquN796q3QxVNZTiB
MD5:	19D1C7AB66E7C5A2348B7C686C1D8596
SHA1:	09C458674FAA70C0C01A2BEADF1D94344A68625A
SHA-256:	7EBC7C8A4DCF9013063D60E1E45D6C434B9C26F5494CE9B361054F4FF804668B
SHA-512:	2D9B010BE167E5350B13FB2CBE44FA9C549B1DFEB66CAD84F447CF95DCD58B91486ADF75DF45358E656BE65267000578DB50A82E2866DF27FCA9E400BBB4ED78
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\55a3ed95-0bb9-4b6b-9d80-32968394bbf3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D7B94E-2358.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.311688582774692
Encrypted:	false
SSDEEP:	3072:gWGMADauiLxFh2M28RXZUib2kUjopZ6bWFeL0z0x4LaObLz5XRKqoiSqIf1zKu3n:XBvW7opZ6Eb43/AaHKgJ
MD5:	FB1D48F094AD52680ABEE10A90E23000
SHA1:	26303A681B0545676033523FAF6804154F0C9CA8
SHA-256:	9BC2B1C8195907D51B0AE6DF54D082FF05439377668EE5B16830F168F798890D
SHA-512:	BF1332DF04B2734D1EE256A8875EAFB49E4CAA065B295E2594349A9839F125B9FE53D021BFC45CA0F4375A9F5072528B3204943A7C32C564E2F133E23F2FE9E6
Malicious:	false
Preview:	...@..@...@.....C.].....@...............pO...K..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".bafoxq20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D7B957-2698.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03970384066827428
Encrypted:	false
SSDEEP:	192:snn0EbtmqvDtKX79aJEa3XxxTVwg7XfiV0D8c4PhARVNg+O1gQtmorpq01n8y08s:s0EtzeQtyxhilag9oFX108T2RGOD
MD5:	57C17961AED25BFD1E6AD79DCBF1AAAB
SHA1:	A582F42D67CB8C7493C9C89CE441893AF44073CD
SHA-256:	4ED0F0D4B61F326C6BC911063A4E5A462FC28FB424AB85336B3302CBA0CC8D75
SHA-512:	25DE4B9A4901965160E6C9A9D8C07FD25058662FD8C3E7B0E15DB152DECDE7260610D5A24A2593548064FA59F9791E29E35843D437E517CB38F2129340FFD6B4
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".bafoxq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D7B95F-2234.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03877100545310284
Encrypted:	false
SSDEEP:	192:BSU0EbtmqvD3KX7ejJEa3Xxx7UpXxgg6zfhj1NEroDtM1gQMyEOW8qln8y08TcmQ:j0EtdjeZVQh53BsguEGS08T2RGOD
MD5:	CE04D43589A5285342E256576D22288A
SHA1:	14F880F6A41C35ED6ABC151EF9F8C21C6251DAC1
SHA-256:	5634B96FF3C040C4B75CC3F01B0A24479A98BA1F99E55087FC7F326EAB83164D
SHA-512:	D281670181D61D8E853F3D4ADDEF098B11513C0ECB0841600BCA6011CFCC8D84D226293A9BB79093EA181E314DE47DE433D2AC9CC925815DA13582D5E824057A
Malicious:	false
Preview:	...@..@...@.....C.].....@................\..PL..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".bafoxq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D7B96C-1C38.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0388259539923847
Encrypted:	false
SSDEEP:	192:gv0EbtmqvD3KX7eTJEa3Xxx7UpXxgg6zfhj1NErZGtM1gQMyzOyWq2n8y08Tcm2D:00EtdTeZVQh5WWsguzsh08T2RGOD
MD5:	E49AB90FDB6281376ABCFC5F0C8F73EA
SHA1:	FE2A363998B56226378C9D77A7B4155E5A15FAA2
SHA-256:	DCAF3655C7DA447EC7327C616AA6D7720E1E884EEE8E1B17F32DB24E3C3013E3
SHA-512:	31D65718002C5EB1AE964D2FC0E189C2FA6CB3710ECE767291C33ACEDC11B7442F45985ADE5B5DB428726352892ADFD48868D054DB4DFAA3D192C9AB9F0EDAEA
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".bafoxq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\168c8be0-245b-4e17-af49-d63771dbe096.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.182074393969585
Encrypted:	false
SSDEEP:	96:sVsqlxJ1Xb95NhsYXYzeSwoMXX+YksY5Th6Cp9/x+6M8muecmAeCZMHe4zvrD2Xo:sVsOJtsYbSwnOYksYPpj+FVAjKDFBf
MD5:	6BD0A1DA6079FC9BD5269C22412729DA
SHA1:	7D014F38D174B908406AC2367860DAD4A670A05F
SHA-256:	10C44B5E9DAF892DB655F4978831F2F24953E5A127FA05D8D02C94190340C9BA
SHA-512:	B45F4B88CF7FBEF84C5A16DA41FFA39C97F2E2F5BE88338DB1CD4902C5110813843BF99796FBEE9CA857EEEDE0B1EE3A084D596D4B60336DE6F22432C5903FE5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369887311266156","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1d281690-99ed-4219-b48d-5d9016eed280.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.072050831714056
Encrypted:	false
SSDEEP:	96:sVsqlxJ1Xb95NhsYXYzeSwo+YksY5Th6Cp9/x+6M8muecmAeCfe4zvrD2X6gE5Ak:sVsOJtsYbSwJYksYPpj+FVAHDFBf
MD5:	0325F0E38A86533E90832C1D1A5EE705
SHA1:	60CA30B007873F3CF717A685840684B0B8B7F1BB
SHA-256:	1BC7B407346796D87D34478DE2EE59F5FB4DBEB17689CCCC3FE637C62214C483
SHA-512:	F82E684CB5D6F10CF6B43264514929322D69029CE4FECAE0E16A2EDD7F3C83B000CE1A2D99BCF4103A0DC2F363D32D19C1B14F0900B4717CB8A2CEC1D9CCBC09
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369887311266156","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5ad98ace-45d1-460e-96bc-e2871fb1aef7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5cbb7ea3-7987-4dae-8d14-eb25eaedae29.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.565111305578315
Encrypted:	false
SSDEEP:	768:EFHz1c7pLGLvyzWP4SfFx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMwjFyEXrw6p2ty:EFHz1AcvyzWP4SfFxu1jatwj4EEDty
MD5:	ACEDD84F398ED674E03BDCD6A042E89C
SHA1:	B3DFF79AE1B6E391CA8AA28BC291093E02FDDD8C
SHA-256:	C3700FBC9ADF2C6C691584FC79749825C43A37572441EB5E6EC7263C8CCF3157
SHA-512:	3CD263BB1735A2FA285461B8D084D38009A4958118EEA5DED668D7BCEA13C30658B9EF20F3E9D32CCD6B9B099C0320CBF742D4BA6589D2DB4252085456DB51FA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369887311033135","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369887311033135","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\670d3276-6eae-4e13-9456-05e67accac12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557382628792572
Encrypted:	false
SSDEEP:	768:EFHz1c7pLGLvyzWP4Sfax8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMFyEXrwIp2tuA:EFHz1AcvyzWP4Sfaxu1jaB4EE1tr
MD5:	0583ABBD6C89872CE369AD13E6E47413
SHA1:	0EEE3EE4B23D13C10CD983B2FB398D5DC45BCD0B
SHA-256:	7543AB44898AB5F1DE37B76AFB88F17D5A1A1E0C480F1071E88C6BF9FB51CDAE
SHA-512:	3B0832084CF1BC24E902CC39B49C4F762535AB7F41CC676FA39E376B5CCF9C18D41EDF8950914FEBF19F5CD5E084796D54A169871E2960767F33C1D92CAB04DA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369887311033135","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369887311033135","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321633953350475
Encrypted:	false
SSDEEP:	192:oAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:LOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	30BBA5ACE567AB953ECE29F8A795EB73
SHA1:	5BE06A298A3091D1106F3347F425477CB7C233A9
SHA-256:	3C46944A13461652DF51083D61B1DD9BD141737D6524856F443EC5A874871F5A
SHA-512:	5593E5AEACF00053D6441D5CB4090591B5B768176481E65FF06E646C7CA7D685985FB257E0AA8D65EAD398F51612841E10F629FC41F17FE6938CE64865CE2605
Malicious:	false
Preview:	...m.................DB_VERSION.12....................QUERY_TIMESTAMP:arbitration_priority_list4...13369887313746737.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.158502378286617
Encrypted:	false
SSDEEP:	6:PB0bQcd0q1wkn23oH+Tcwt9Eh1ZB2KLllB0bS4/SQ+q2Pwkn23oH+Tcwt9Eh1tIg:PB0pe1fYeb9Eh1ZFLnB02dVvYfYeb9Ev
MD5:	095F194505BD0B0F383EF9E210EBE938
SHA1:	D8B58D756D26211506E8DF1A1DA3F84A75840F98
SHA-256:	35923746CBCE880AF3E45068170F36F9D0AC86C1669B26F60EFB0A28C0E8A366
SHA-512:	F5A60A4CFDB2F7D7818BE26B1B5BB951EBF4A343B0DE3B8EA89F7FEEC7624AD76BCE254F21423D93D4D4E89154B7EAF95830890A956318CBB8A0CE907798AED7
Malicious:	false
Preview:	2024/09/03-21:35:12.696 1b88 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/09/03-21:35:12.724 1b88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlA2a+/:Ls3A4
MD5:	E24251D8187F4EA65DAAB0858147E2F0
SHA1:	491C35E3606132B4CF9931524EF69023A558A5AC
SHA-256:	B30F168AE6E13E5CA66534C2680F1804670B04498F6A4CC8F86116B4A5877424
SHA-512:	03E00AB931519A399A56AB65BCE2D08AA5E1D09B2DF437FA7DA60F5669ED57A4D5840964329510FF2AB8736B2F73BBA6E2E49BB010C73DE34753A64CFB9BEC44
Malicious:	false
Preview:	.........................................4.w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.186447627881403
Encrypted:	false
SSDEEP:	6:PB0UgPRq1wkn23oH+TcwtnG2tbB2KLllB0UeUIq2Pwkn23oH+TcwtnG2tMsIFUv:PB0lR1fYebn9VFLnB0iIvYfYebn9GFUv
MD5:	24538BD2EFF0E571FA0B2A44BC5D0230
SHA1:	FB873A39DDEC7035AC49B1E58AACD549EBBD0CEA
SHA-256:	E0A6F772B030071EC795CCDDA62639B30FB5D76F93CE3844667F84C56D49ECF9
SHA-512:	67D312A9D076DB398E19C9B839E4FB1EDF5395BD94D11BFFAD23E76D6D8DE1352B13725FDE37210506CACD84B1799A0C572D1DB01ECF41671E488BB479090539
Malicious:	false
Preview:	2024/09/03-21:35:11.218 23f0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/09/03-21:35:11.232 23f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.178675399608033
Encrypted:	false
SSDEEP:	6:PB0U1AB1wkn23oH+Tcwt8aVdg2KLllB0Uk2+q2Pwkn23oH+Tcwt8aPrqIFUv:PB0AfYeb0LnB0j3vYfYebL3FUv
MD5:	099B2FCB8E34AF0449E61874FF61EEA5
SHA1:	A0B1E89A07AFFC8837FEF984241314A27D711EF0
SHA-256:	ED1FE3D86F248FE0B28FF782E660F30261A4E719103906A1F16F331C8110C887
SHA-512:	DB29A24AA967ABB5CE310967DBBA54669260C2097BDF1C572BDB41CEF20FB0AEA8715E8D3147D00DDB1D5CC5D48D7191E1E21A2DD555E93D0D1B6021E4222785
Malicious:	false
Preview:	2024/09/03-21:35:11.451 23f8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/09/03-21:35:11.504 23f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.189638349932335
Encrypted:	false
SSDEEP:	6:PB0UkhFB1wkn23oH+Tcwt86FB2KLllB0UkUZA+q2Pwkn23oH+Tcwt865IFUv:PB0jAfYeb/FFLnB0jIFvYfYeb/WFUv
MD5:	5B40303FF8AB74915B1DCAD6FC5BF346
SHA1:	CC8B5CE9CAE010FD1C26C7126B1A49F7ACF14308
SHA-256:	02B4F6F7B89F881DD5E766521676F0D5B868E224054FEAE97B17453F7BB4B9C4
SHA-512:	8FE996AAB63DFB6ED5BA62D7EED6CFA9FE4133F63AF9EF4B3109D699D620006C2659380704587DDB76E197B2DF5DB1128154C5EE86E0F1B0246E479E1E0F51E5
Malicious:	false
Preview:	2024/09/03-21:35:11.507 23f8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/09/03-21:35:11.516 23f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.164382079406189
Encrypted:	false
SSDEEP:	6:PB0UkFt+q2Pwkn23oH+Tcwt8NIFUt82B0UkF5Zmw+2B0UkyNVkwOwkn23oH+TcwY:PB0jFovYfYebpFUt82B0jF5/+2B0jyzS
MD5:	8F199C596E5531734AE6871112654AB7
SHA1:	26C2FE3226F776781BAC99EA6B4179F3BE2DEE14
SHA-256:	C5CC3DABAB2D9CD239F8AD27349CF0C8CE5B93450FC0DD5B066AD941D28A0FE0
SHA-512:	4766DB4753BDCA060685ED0C2D008BF3E610ABEEA6355B54B2F2B87A7B2B3F64A7B5E10FFCAB778E8F4BC96E69E3383EB61ABF79221B6BA1ED1AECD8403070E6
Malicious:	false
Preview:	2024/09/03-21:35:11.521 23f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/03-21:35:11.521 23f8 Recovering log #3.2024/09/03-21:35:11.522 23f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.164382079406189
Encrypted:	false
SSDEEP:	6:PB0UkFt+q2Pwkn23oH+Tcwt8NIFUt82B0UkF5Zmw+2B0UkyNVkwOwkn23oH+TcwY:PB0jFovYfYebpFUt82B0jF5/+2B0jyzS
MD5:	8F199C596E5531734AE6871112654AB7
SHA1:	26C2FE3226F776781BAC99EA6B4179F3BE2DEE14
SHA-256:	C5CC3DABAB2D9CD239F8AD27349CF0C8CE5B93450FC0DD5B066AD941D28A0FE0
SHA-512:	4766DB4753BDCA060685ED0C2D008BF3E610ABEEA6355B54B2F2B87A7B2B3F64A7B5E10FFCAB778E8F4BC96E69E3383EB61ABF79221B6BA1ED1AECD8403070E6
Malicious:	false
Preview:	2024/09/03-21:35:11.521 23f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/03-21:35:11.521 23f8 Recovering log #3.2024/09/03-21:35:11.522 23f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.32804183070518517
Encrypted:	false
SSDEEP:	6:NMA/J3+t76Y4QZZofU99pO0BYeaqR4EZY4QZvGnhH:NdhHQws9LdhBQZGR
MD5:	E2DB71AE7A00C88E0A9E2B5A471A6B16
SHA1:	039A1BE54E14558457CE8ADB7C9D5A42628AA271
SHA-256:	0D1D2CB59678ED24117B6BEDCACB3DF645EBACE9DA552DB1DD6D3FEE883B1D44
SHA-512:	52614EE56DA8A225918B6C253D6D601D9F481F20FED7BA45224D3EB103AC8A6F9E7A6EE0497C8847F05543BABE6722064252029F4B0026A306B45232C51EB689
Malicious:	false
Preview:	............(.."...'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.241572662363919
Encrypted:	false
SSDEEP:	12:PB0iQL+vYfYeb8rcHEZrELFUt82B0zzdW/+2B0JQLV5JfYeb8rcHEZrEZSJ:CYYfYeb8nZrExg8kDJfYeb8nZrEZe
MD5:	45007FDAB70A938B6D0DB3D7503E3D13
SHA1:	FBB3C20C47E3328903E3DC95AA6697B1BB28D120
SHA-256:	C175AC619058CDE0E2C2348CE54DDE14C81A71FF945FE9336C19AD092BFB8317
SHA-512:	60602E6FE3C1F165D033E6B2CA769CDDE71CFEB634848B6017B028E5B544B0A50A4228E12BC4688DFD7F6C3F636DEA3CEF6AE21DBA3B024C7F9955305174B85C
Malicious:	false
Preview:	2024/09/03-21:35:12.254 23cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/03-21:35:12.255 23cc Recovering log #3.2024/09/03-21:35:12.262 23cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.241572662363919
Encrypted:	false
SSDEEP:	12:PB0iQL+vYfYeb8rcHEZrELFUt82B0zzdW/+2B0JQLV5JfYeb8rcHEZrEZSJ:CYYfYeb8nZrExg8kDJfYeb8nZrEZe
MD5:	45007FDAB70A938B6D0DB3D7503E3D13
SHA1:	FBB3C20C47E3328903E3DC95AA6697B1BB28D120
SHA-256:	C175AC619058CDE0E2C2348CE54DDE14C81A71FF945FE9336C19AD092BFB8317
SHA-512:	60602E6FE3C1F165D033E6B2CA769CDDE71CFEB634848B6017B028E5B544B0A50A4228E12BC4688DFD7F6C3F636DEA3CEF6AE21DBA3B024C7F9955305174B85C
Malicious:	false
Preview:	2024/09/03-21:35:12.254 23cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/03-21:35:12.255 23cc Recovering log #3.2024/09/03-21:35:12.262 23cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.167987846689582
Encrypted:	false
SSDEEP:	6:PB0UocmiVq2Pwkn23oH+Tcwt8a2jMGIFUt82B0UoceSgZmw+2B0UoccIkwOwkn2o:PB0vmvYfYeb8EFUt82B0vB/+2B0vO5Jg
MD5:	A4BEB4F557A001D491366BC374620355
SHA1:	BC380B58EE55626FC8007A35F5B3A06ED3F4F29C
SHA-256:	501F38E4E6FF9A9F9C4193B6C685A52CDD7F81F4F9315FC7DCFE7C440E111B9A
SHA-512:	2AB39CE603891BE84F9D991506C7EBB17293B812741AE782B32EA9468B89679B268C70734C3924968AD1A634CE3AB1F8E9D3F7E6AF01A27B2A88F4B64E7E90C8
Malicious:	false
Preview:	2024/09/03-21:35:11.991 22d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/03-21:35:11.993 22d4 Recovering log #3.2024/09/03-21:35:11.996 22d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.167987846689582
Encrypted:	false
SSDEEP:	6:PB0UocmiVq2Pwkn23oH+Tcwt8a2jMGIFUt82B0UoceSgZmw+2B0UoccIkwOwkn2o:PB0vmvYfYeb8EFUt82B0vB/+2B0vO5Jg
MD5:	A4BEB4F557A001D491366BC374620355
SHA1:	BC380B58EE55626FC8007A35F5B3A06ED3F4F29C
SHA-256:	501F38E4E6FF9A9F9C4193B6C685A52CDD7F81F4F9315FC7DCFE7C440E111B9A
SHA-512:	2AB39CE603891BE84F9D991506C7EBB17293B812741AE782B32EA9468B89679B268C70734C3924968AD1A634CE3AB1F8E9D3F7E6AF01A27B2A88F4B64E7E90C8
Malicious:	false
Preview:	2024/09/03-21:35:11.991 22d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/03-21:35:11.993 22d4 Recovering log #3.2024/09/03-21:35:11.996 22d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1ad9c37b-ef1c-48ef-8b88-e25b777583ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5142a545-af3b-475a-8c6d-193fe2996575.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\53228091-52bf-4ef3-88d5-31bdb19e67b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\560322a7-4576-4772-afa1-e9cdbb8a6d00.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\767a0b5c-538f-4ef7-b26a-1504a8d8424d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2f11c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3dca5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2ca0c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2d586.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2f11c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a6c65ee9-fd5c-4656-8be2-ac45b62a88ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.300477334521148
Encrypted:	false
SSDEEP:	24:YXsIdZVMdBsIXSyZFRudFGcsI6VYZFGJ/dbG7nby:YXsIb8sIPfcdsI6VogzbZ
MD5:	426F68B961CAB3E49F7CF5CE60A0A176
SHA1:	DFAAD09D4E0A263769375C041B256ADD2A6FFCAE
SHA-256:	C0C12661E951F897FB66582D82B6EE5874C38C9A7466343C01B782577F7A17B9
SHA-512:	078A587BBADD6643FC842FF3F20F6D0A12B31B0742E232292D54E456913CC2AFB2356A41BCD2ED83E22B97E44AD696CEA2A9AFC9011C58EE57B9C8A5FFD6DEE8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372479313059434","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372479314052106","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372479316703318","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d4607746-28a8-49d0-a908-ded0daf85b53.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.072050831714056
Encrypted:	false
SSDEEP:	96:sVsqlxJ1Xb95NhsYXYzeSwo+YksY5Th6Cp9/x+6M8muecmAeCfe4zvrD2X6gE5Ak:sVsOJtsYbSwJYksYPpj+FVAHDFBf
MD5:	0325F0E38A86533E90832C1D1A5EE705
SHA1:	60CA30B007873F3CF717A685840684B0B8B7F1BB
SHA-256:	1BC7B407346796D87D34478DE2EE59F5FB4DBEB17689CCCC3FE637C62214C483
SHA-512:	F82E684CB5D6F10CF6B43264514929322D69029CE4FECAE0E16A2EDD7F3C83B000CE1A2D99BCF4103A0DC2F363D32D19C1B14F0900B4717CB8A2CEC1D9CCBC09
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369887311266156","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF343d0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.072050831714056
Encrypted:	false
SSDEEP:	96:sVsqlxJ1Xb95NhsYXYzeSwo+YksY5Th6Cp9/x+6M8muecmAeCfe4zvrD2X6gE5Ak:sVsOJtsYbSwJYksYPpj+FVAHDFBf
MD5:	0325F0E38A86533E90832C1D1A5EE705
SHA1:	60CA30B007873F3CF717A685840684B0B8B7F1BB
SHA-256:	1BC7B407346796D87D34478DE2EE59F5FB4DBEB17689CCCC3FE637C62214C483
SHA-512:	F82E684CB5D6F10CF6B43264514929322D69029CE4FECAE0E16A2EDD7F3C83B000CE1A2D99BCF4103A0DC2F363D32D19C1B14F0900B4717CB8A2CEC1D9CCBC09
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369887311266156","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d4a6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.072050831714056
Encrypted:	false
SSDEEP:	96:sVsqlxJ1Xb95NhsYXYzeSwo+YksY5Th6Cp9/x+6M8muecmAeCfe4zvrD2X6gE5Ak:sVsOJtsYbSwJYksYPpj+FVAHDFBf
MD5:	0325F0E38A86533E90832C1D1A5EE705
SHA1:	60CA30B007873F3CF717A685840684B0B8B7F1BB
SHA-256:	1BC7B407346796D87D34478DE2EE59F5FB4DBEB17689CCCC3FE637C62214C483
SHA-512:	F82E684CB5D6F10CF6B43264514929322D69029CE4FECAE0E16A2EDD7F3C83B000CE1A2D99BCF4103A0DC2F363D32D19C1B14F0900B4717CB8A2CEC1D9CCBC09
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369887311266156","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557382628792572
Encrypted:	false
SSDEEP:	768:EFHz1c7pLGLvyzWP4Sfax8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMFyEXrwIp2tuA:EFHz1AcvyzWP4Sfaxu1jaB4EE1tr
MD5:	0583ABBD6C89872CE369AD13E6E47413
SHA1:	0EEE3EE4B23D13C10CD983B2FB398D5DC45BCD0B
SHA-256:	7543AB44898AB5F1DE37B76AFB88F17D5A1A1E0C480F1071E88C6BF9FB51CDAE
SHA-512:	3B0832084CF1BC24E902CC39B49C4F762535AB7F41CC676FA39E376B5CCF9C18D41EDF8950914FEBF19F5CD5E084796D54A169871E2960767F33C1D92CAB04DA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369887311033135","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369887311033135","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF32982.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.557382628792572
Encrypted:	false
SSDEEP:	768:EFHz1c7pLGLvyzWP4Sfax8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMFyEXrwIp2tuA:EFHz1AcvyzWP4Sfaxu1jaB4EE1tr
MD5:	0583ABBD6C89872CE369AD13E6E47413
SHA1:	0EEE3EE4B23D13C10CD983B2FB398D5DC45BCD0B
SHA-256:	7543AB44898AB5F1DE37B76AFB88F17D5A1A1E0C480F1071E88C6BF9FB51CDAE
SHA-512:	3B0832084CF1BC24E902CC39B49C4F762535AB7F41CC676FA39E376B5CCF9C18D41EDF8950914FEBF19F5CD5E084796D54A169871E2960767F33C1D92CAB04DA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369887311033135","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369887311033135","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.153612727840367
Encrypted:	false
SSDEEP:	6:PBSVq2Pwkn23oH+TcwtrQMxIFUt82Bu3SgZmw+2BlIkwOwkn23oH+TcwtrQMFLJ:PBOvYfYebCFUt82BuH/+2Bu5JfYebtJ
MD5:	0DF7AC7E07AD772119E277245567993A
SHA1:	9955B101A3A19FFF3CE89D6B8A6B35CEBAB0A1F5
SHA-256:	BD585D7DC7256DACB3F3328BF6EA408F2DED7179451C45B650C05D4FE3D2434E
SHA-512:	737AF6D8231A7812D88697C1316AC63155EFE15276613E2F900AA11CB39361E42B89292E344E59351002286608884623EA334C9AA737D66CB74669405F796798
Malicious:	false
Preview:	2024/09/03-21:35:27.276 22d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/03-21:35:27.277 22d4 Recovering log #3.2024/09/03-21:35:27.280 22d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.153612727840367
Encrypted:	false
SSDEEP:	6:PBSVq2Pwkn23oH+TcwtrQMxIFUt82Bu3SgZmw+2BlIkwOwkn23oH+TcwtrQMFLJ:PBOvYfYebCFUt82BuH/+2Bu5JfYebtJ
MD5:	0DF7AC7E07AD772119E277245567993A
SHA1:	9955B101A3A19FFF3CE89D6B8A6B35CEBAB0A1F5
SHA-256:	BD585D7DC7256DACB3F3328BF6EA408F2DED7179451C45B650C05D4FE3D2434E
SHA-512:	737AF6D8231A7812D88697C1316AC63155EFE15276613E2F900AA11CB39361E42B89292E344E59351002286608884623EA334C9AA737D66CB74669405F796798
Malicious:	false
Preview:	2024/09/03-21:35:27.276 22d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/03-21:35:27.277 22d4 Recovering log #3.2024/09/03-21:35:27.280 22d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.124289142720429
Encrypted:	false
SSDEEP:	6:PB0Ugx3QL+q2Pwkn23oH+Tcwt7Uh2ghZIFUt82B0UgUGG1Zmw+2B0UgUGQLVkwOV:PB0nxgyvYfYebIhHh2FUt82B0n8/+2Bm
MD5:	812EC492BEAA2170C2EA0E53E32A5E31
SHA1:	FFDCAD03BFD4497002BACF4CC0A23C81C4E53FAA
SHA-256:	2DD6D89D8837B244513C19CF8A61CB7824B90E7BFE6C00230D127D58FA8FEF76
SHA-512:	A6CAB5A6E9E77AF981CB2695094B408381855211667684251E5F701EA56FCFDBA919F7FA29DE3909C91F5DA76216B6036354A163FB18D8E688A4246904CF81A0
Malicious:	false
Preview:	2024/09/03-21:35:11.109 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/03-21:35:11.110 1da8 Recovering log #3.2024/09/03-21:35:11.110 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.124289142720429
Encrypted:	false
SSDEEP:	6:PB0Ugx3QL+q2Pwkn23oH+Tcwt7Uh2ghZIFUt82B0UgUGG1Zmw+2B0UgUGQLVkwOV:PB0nxgyvYfYebIhHh2FUt82B0n8/+2Bm
MD5:	812EC492BEAA2170C2EA0E53E32A5E31
SHA1:	FFDCAD03BFD4497002BACF4CC0A23C81C4E53FAA
SHA-256:	2DD6D89D8837B244513C19CF8A61CB7824B90E7BFE6C00230D127D58FA8FEF76
SHA-512:	A6CAB5A6E9E77AF981CB2695094B408381855211667684251E5F701EA56FCFDBA919F7FA29DE3909C91F5DA76216B6036354A163FB18D8E688A4246904CF81A0
Malicious:	false
Preview:	2024/09/03-21:35:11.109 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/03-21:35:11.110 1da8 Recovering log #3.2024/09/03-21:35:11.110 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul5vu:Ls2
MD5:	94057387D9FA36251E79ACFB47DD44BA
SHA1:	E6E810128ADFEB170AA9DD6C717294459CF0D7AF
SHA-256:	D13C1D2CAECD961A4FCDCACE027C36D7D4AED9C5F7105526B1CC1DBBFFDA271D
SHA-512:	8A5AF34A42F62671EB12E6ECCA51D20DCA4086D75DF3680793776AD9AFD974D1BC3777400DC21D5504F87E63BAB14AF7C494C1EBF173FEA9920C18B137C2EA5B
Malicious:	false
Preview:	........................................-.3x../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlQsal:Ls3
MD5:	424B71CCF7D2A809E6B3EB8D81C68513
SHA1:	35449224FF7FF933FEA955625BFFD32C012D26E4
SHA-256:	074EB954EB2BB3CE4402108D5B1408CFF2549F4B0BBF7A37CEBBC993566A4249
SHA-512:	88A0D9B330469849B6AA65DC3A023A25A95462498146CD84DCE27FB207A4A4D82E9C4481E22D4B9636D493009AA45CA5E67C6BE239506D08B2979EF018F9B3F6
Malicious:	false
Preview:	........................................[..w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.222693315461972
Encrypted:	false
SSDEEP:	12:PB02OvYfYebvqBQFUt82B0o/+2B0SCHF5JfYebvqBvJ:0YfYebvZg8NXJfYebvk
MD5:	FC4B00E9D31D17BA4D1973B88D9BE2E7
SHA1:	D484F347AF2E2EEFE1B79B07ADAD637FC848C93D
SHA-256:	F976FD3CCE8A7F82941FED76986FC86CE2C2E7EB9C8D44CC34ED3BCBB89040D8
SHA-512:	7E093362CFB464A4E456BC757FFF88ECBB39D422BB7FD16D87037499C7541891437084A94297CF264B9980D0A7E0812EFE2E1A7A2211ADA73EACA08AE28181BE
Malicious:	false
Preview:	2024/09/03-21:35:12.007 22d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/03-21:35:12.009 22d4 Recovering log #3.2024/09/03-21:35:12.013 22d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.222693315461972
Encrypted:	false
SSDEEP:	12:PB02OvYfYebvqBQFUt82B0o/+2B0SCHF5JfYebvqBvJ:0YfYebvZg8NXJfYebvk
MD5:	FC4B00E9D31D17BA4D1973B88D9BE2E7
SHA1:	D484F347AF2E2EEFE1B79B07ADAD637FC848C93D
SHA-256:	F976FD3CCE8A7F82941FED76986FC86CE2C2E7EB9C8D44CC34ED3BCBB89040D8
SHA-512:	7E093362CFB464A4E456BC757FFF88ECBB39D422BB7FD16D87037499C7541891437084A94297CF264B9980D0A7E0812EFE2E1A7A2211ADA73EACA08AE28181BE
Malicious:	false
Preview:	2024/09/03-21:35:12.007 22d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/03-21:35:12.009 22d4 Recovering log #3.2024/09/03-21:35:12.013 22d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3ea335e2-a3c4-494f-9a46-15f7a62eb8fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\4a0d3916-cf35-4a73-8729-fd78b6001b75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7fa57a3b-6b25-4a6e-830b-f9dbc1df9d3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3ee1a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2d596.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a637f6f8-a9e2-4c0e-9fe8-69277176dcbd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.250960237038923
Encrypted:	false
SSDEEP:	12:PBCvYfYebvqBZFUt82B9/+2BE5JfYebvqBaJ:qYfYebvyg8zJfYebvL
MD5:	891DBFE1255015E31FF5AC7DFDAC671F
SHA1:	43C58DFCBCF2BDB831DF6B757DB4A2E3D0C35168
SHA-256:	13ECC59607ECD475C63886999CFFBC52806F5813610A5725C0B72AB487E2CE56
SHA-512:	F88124F11A0FD987B5CCEC92BA3C1FDAD6DDC3C053CF87EF1381C3D298411BCF0BE6F799CE97C71AA428EB8FC65E3107204889DAB4D7F4E40ACB322A2F84E58F
Malicious:	false
Preview:	2024/09/03-21:35:27.214 22d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/03-21:35:27.216 22d4 Recovering log #3.2024/09/03-21:35:27.219 22d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.250960237038923
Encrypted:	false
SSDEEP:	12:PBCvYfYebvqBZFUt82B9/+2BE5JfYebvqBaJ:qYfYebvyg8zJfYebvL
MD5:	891DBFE1255015E31FF5AC7DFDAC671F
SHA1:	43C58DFCBCF2BDB831DF6B757DB4A2E3D0C35168
SHA-256:	13ECC59607ECD475C63886999CFFBC52806F5813610A5725C0B72AB487E2CE56
SHA-512:	F88124F11A0FD987B5CCEC92BA3C1FDAD6DDC3C053CF87EF1381C3D298411BCF0BE6F799CE97C71AA428EB8FC65E3107204889DAB4D7F4E40ACB322A2F84E58F
Malicious:	false
Preview:	2024/09/03-21:35:27.214 22d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/03-21:35:27.216 22d4 Recovering log #3.2024/09/03-21:35:27.219 22d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.196591506634108
Encrypted:	false
SSDEEP:	6:PB0U2q2Pwkn23oH+TcwtpIFUt82B0US1XZmw+2B0US1FkwOwkn23oH+Tcwta/WLJ:PB0zvYfYebmFUt82B071X/+2B071F5Jr
MD5:	7B536819F23CA41928873F6B1F00C78A
SHA1:	E18409FE63B40419FB6184CC1B8DEE379D5844F5
SHA-256:	A3B6A1042B3E9DD35A63A606DED1FDE71F725147443F21973840CB3A103F2990
SHA-512:	E3967282DC1BCC173F1B14CF09F575867646B4DBB996F345FE2A831B2C135722F79CC757F02251EDE3C24F721A6C0DD68C791F5001A6123BD2F508025F587366
Malicious:	false
Preview:	2024/09/03-21:35:11.444 20b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/03-21:35:11.445 20b0 Recovering log #3.2024/09/03-21:35:11.445 20b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.196591506634108
Encrypted:	false
SSDEEP:	6:PB0U2q2Pwkn23oH+TcwtpIFUt82B0US1XZmw+2B0US1FkwOwkn23oH+Tcwta/WLJ:PB0zvYfYebmFUt82B071X/+2B071F5Jr
MD5:	7B536819F23CA41928873F6B1F00C78A
SHA1:	E18409FE63B40419FB6184CC1B8DEE379D5844F5
SHA-256:	A3B6A1042B3E9DD35A63A606DED1FDE71F725147443F21973840CB3A103F2990
SHA-512:	E3967282DC1BCC173F1B14CF09F575867646B4DBB996F345FE2A831B2C135722F79CC757F02251EDE3C24F721A6C0DD68C791F5001A6123BD2F508025F587366
Malicious:	false
Preview:	2024/09/03-21:35:11.444 20b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/03-21:35:11.445 20b0 Recovering log #3.2024/09/03-21:35:11.445 20b0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:del1lhtlzj:03f
MD5:	ECED709816C2A14B673EC44513349902
SHA1:	A4D9F3DA94423D18D8BEC6C94FDFF0A55A813860
SHA-256:	6154467843F11053424F7A02817228F30902C307124B5CE4FFD4E84AE1CE209A
SHA-512:	50A3006CB7375AF2F89138C7685B91221164700808473ADC75D4049E5AFC2541AB5B0B1AEF504C87D0FB0D07DF1F88892BAF7ADE47A54E2FC7386DE957FC6758
Malicious:	false
Preview:	.............?.u...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b50c5020-ce6e-423e-899d-3b4112fc530c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9333
Entropy (8bit):	5.180593510331856
Encrypted:	false
SSDEEP:	96:sVsqlxJ1Xb95NhsYXYzeSwoMXX+YksY5Th6Cp9/x+6M8muecmAeCXXHe4zvrD2Xo:sVsOJtsYbSwnOYksYPpj+FVAZ9DFBf
MD5:	40A14FC243976A5E6EA4CF47B3E7A991
SHA1:	9705864E6D9B6D7F3740A93DFEC5FDB24563ABDF
SHA-256:	1538A4DEFCB606B5391D72F8BCC8A893FFEFC5D42CD4458244BDBB20D72037CA
SHA-512:	97A759C8A24357B5CC9217E46E1E3E4C50DD55ACFDDBEF7B9ECC079BC4CADFBB2413282BE10319E873317EF57BD9AE02CE9860E1F758A556A28F5FBC48F1BCB2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369887311266156","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c674e3df-cfb1-44fb-8fa0-fc15e7ca8244.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.3202647915723045
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQvxlsRzvll3seGKT9rcQ6xKyOtl:/XntM+4lsVvll3sedhOnO
MD5:	D948166E09696CD57D1058BE55BF809C
SHA1:	ED2BDB020D385408D7C34466C9803C445E832A7D
SHA-256:	E3A25A361E5CDFC9B7A0040F25D6BA096CCEB86CC4DF05AE4BB7D379E1B00C63
SHA-512:	719339EA2A59DEE61C0E158775AA6F03A939625278A0D44ABB5F20FE2D84655BE2E5212B5BE76E35D648025EE70E77D12C4DECC25C3B00BAB3437E3676AB4C72
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.................t.0................39_config..........6.....n ...1u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.232765330463941
Encrypted:	false
SSDEEP:	6:PB0UFFGGD1wkn23oH+Tcwtfrl2KLllB0UPGIq2Pwkn23oH+TcwtfrK+IFUv:PB0KCfYeb1LnB0OvYfYeb23FUv
MD5:	8EBE96B3B3A6C3CAEFB1DC951CA43220
SHA1:	C6CA13780AED45BD8A3320B62E05A4853DF654A1
SHA-256:	83E9BCDFFDEB0FC367E2E0855192BC996CD877184B2FC6D4F6E129F9D2379CE5
SHA-512:	5AFE5DBC40A9E2CC0DC3994F0CD7BCA59E3AECC3359B7E0808DA4F363344018EB0D38869CEB3731DFFAB70877145ABF391434796FA25673354391698FCC96B95
Malicious:	false
Preview:	2024/09/03-21:35:11.286 23c0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/09/03-21:35:11.296 23c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9275169283101077
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/5/Xt21tzJ3PEWXZi+5uh/2Rdj0QWQ0:G0nYUtPrPJ6B/XMtzNP9i+4hORdZx0
MD5:	A21ADD072F290BB8025555CE1EF9014C
SHA1:	BC07D222EF610DCE637F72866D14D7560926EB5C
SHA-256:	1D64B6F3EBA3FC479C8A8A34AB1D17D263E71AC35707450E323DA7E482E48195
SHA-512:	164C693EE34EE72E4401DFF69B7E4CFE2BA100E7F3C8D2665B91BFC200011F808FEF9EB878656CE54478EF7F6B814EAD722C4EDC74F7300BA5E1B696F6CA1CCF
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_........e.................18_......E...................37_.....`0M..................38_......Hf..................39_.......w<.................20_.........................20_..........................19_.....}....................18_......m=.................37_.....uTN..................38_.......h.................39_........I.................21_......j...................21_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.189860102433337
Encrypted:	false
SSDEEP:	6:PB0UaXWGD1wkn23oH+Tcwtfrzs52KLllB0UHFzFIq2Pwkn23oH+TcwtfrzAdIFUv:PB0O5fYebs9LnB046vYfYeb9FUv
MD5:	D0A865D3AEF12F2E717D484647FD5F77
SHA1:	CE4FE40F446ED36E59F716835C015BEC8713CE63
SHA-256:	4E3045C3BA444A2D27115D261E9798FC3A385604858F1D69B659FA27CA7F33C8
SHA-512:	1928E0208156B1B9CED72303B9174528FE15044CD693B186CD0BFC76225D6D5E73CA6EE5A8D32F954B0EC5E0C150882DDCCA3BA25A8DB3D50DAF7762A30C9C48
Malicious:	false
Preview:	2024/09/03-21:35:11.274 23c0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/09/03-21:35:11.284 23c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlqLal:Ls3qL
MD5:	7A9CA1A8E93B4490944354AD29922081
SHA1:	7F63122E3B84CD64B0B4DE8D81493908A95424CF
SHA-256:	A8E21227BC34E45924BC0B7417B8BD59791A1A7332856E46ABC5C060186376D2
SHA-512:	853284C6983E5D30280998734CCDFC7809B3F0F81B30B427F4E380AE8B849F2C583E76FCEADD1B3C60C76CDDF8271CC68C1D6348BD1782778F58BB8FFF64E986
Malicious:	false
Preview:	...........................................w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNl6SJ+/:Ls36S
MD5:	1E1EAEF86B6487E675A8183462A59225
SHA1:	F4F3AC8B268135FA024DB79CA664EA74D219321C
SHA-256:	FE19BDE679871B34B528105707B254F4CE8DFD19604F893B51FA1DB727A2A22E
SHA-512:	2056CBC8A209BC5EDC493A77445B786BACE5511AA482B07B64B0E6ACD8F7CC05A891BC2031B6FE8FAC85610E0D4F56CCF24714E0D7A4502B55DEF3CC516CB2B0
Malicious:	false
Preview:	........................................`..w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2c4dc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2c4ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e45b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e47a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e48a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30495.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF338f3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33903.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ad87.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d497.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF40888.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.793490565734493
Encrypted:	false
SSDEEP:	96:iaqkHfzRqQ5ih/cI9URLl8RotolMFVvlwhBe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akrR8eiRUmhD6qRAq1k8SPxVLZ7VTiq
MD5:	67F8E1640504B983354A91892467A073
SHA1:	F128F3CD8E6E926392BEBA18D4E8A6A3575B431D
SHA-256:	996F2306F39AC178B1739EA576DD83DA13158525D3C3437B59197B45C0871151
SHA-512:	35470C382EFF50DB3521D9883A64232E0C77F1FE226EADF8AF18C7E76558E63879F3E539A38B09CA92D2F87C42BAF36FFD2AA52CA32B887E7F85513FC2BBF97C
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAignVxYwzNRa7AQj/BG/AzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKdpW7DjrPoyBVGu2NWrzP4e3Iu81BIxAeV2KtaO1DwQAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlT:Ls3
MD5:	68ADE3AA1034BF4C7BD4A972F6E8B1E2
SHA1:	AD97740BFE5C055927B2C9443B17A7C0AFD4DC22
SHA-256:	1E22E1D8764AF88A86111C02A618864EC9381092F7A52B1B7EC6213E38C33C3A
SHA-512:	8FED8A42A4747FB6A75ABBFC91F14A59ED22F0BEA8AE4B31A135F09ED3CF56FA9DEDC5EB16A8CEC3BB9DC9E71C359B06812667EED827F1D4AE77B040778B4951
Malicious:	false
Preview:	........................................^_.w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b951180a-6618-4bcf-bd51-113538762d2e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.832394320955408
Encrypted:	false
SSDEEP:	192:fsNwrR6eiRUJ/I1tQ5vcAnyckN796qRAq1k8SPxVLZ7VTiB:fsNwmw/w+5vcAyXN796q3QxVNZTiB
MD5:	3E351CE143398BFB7BFD6E4D7A1410D0
SHA1:	3DE71A891CD2AB6EC735AD45CBC7D79991D57AD5
SHA-256:	AFF42032C0A2F5A2D16D050AEA401A01DB6C8E941F210032EB22D807D93C5B52
SHA-512:	82BC6B551B3D6337FECC1E9F6F65AA99B971237227E0CBE8DE6650F25A4466064998B24848EBED182F628979A3C22F089ED5E22D98945D9A60A46C7F69F6469E
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c27d6c10-35d9-4be7-b7b3-253685f4d3af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24722
Entropy (8bit):	6.0538371032305545
Encrypted:	false
SSDEEP:	384:GtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNOXmGjQazdZzPOoEN555LI0L:qMGQ7FCYXGIgtDAWtJ4ndjbZzP7UB
MD5:	91A8F204749C6BDDC6960480CAAC8C88
SHA1:	5AB6913E6CD9DF3BDA9B40943FA056DE48461B62
SHA-256:	749C41978D8D5316BD98950B7CD001307C08A2C77820B6A8C1A5667FA1270A99
SHA-512:	042681BCFD77F2A680C5028D0ADCFF3E2FA1A573B61DFF9EA57AD1EE0A0BB9D8593256EE44625E77B0370DEEF6E1DCE9930D4E2EC2EF45AE37EF125C9008D38B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369887311449306","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c30e62a3-1b57-42a4-9346-0b842bfa7f94.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60024
Entropy (8bit):	6.083045350878395
Encrypted:	false
SSDEEP:	1536:qMGQ5XMBGQaf8dP0SZUADzQloBo7ZmYIVZzw:qMrJM8RkdP0SZUADzyoBoF3OZzw
MD5:	3ED2AB0DD1FED10417FA720297E48090
SHA1:	032C69C7904316DE3A51E81D57C522C49C7587E8
SHA-256:	790A9F9E7CD60787989B3D2E131D1B4953725C8D6E610FE07C5F92827714894D
SHA-512:	224830F46C8F025BB5A342A7E05AE4091089D637660EE998F471167C7AE571CADF06D91996A56B5993300534733B6C7E4A7C3CCEDEB81F1AEFD92CDFB6FACDFD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369887311449306","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e0fdb109-cf20-455a-b146-048d4bb750a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59896
Entropy (8bit):	6.082668101985716
Encrypted:	false
SSDEEP:	1536:qMGQ5XMBGTaf8dP0SZUADzQloBo7ZmYIVZzw:qMrJM8mkdP0SZUADzyoBoF3OZzw
MD5:	F9F20792831C3DCFDC5048B7F39E0EFE
SHA1:	7B7B48A73BDC1334054BA99C440A9BA291F773AE
SHA-256:	065C5F750BA14ED239E3D1A3415BF749C5E851D2BF5D6769656C0ACE03A6454D
SHA-512:	1AEF10CBCA0BB93FCCBDFF12C15EC1D785E6EB3B10B2C4CE300CA34B0A458CA0506486FF7E9F8D426E37855CA88EA65E6AC05B5A1D9AFC0E9D8AF0B72CB0329A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369887311449306","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e7d6c7ec-4d7f-430c-9d40-daf08490e9c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.799461359804278
Encrypted:	false
SSDEEP:	192:fsNwrR6eiRUJ/zQUkNC6qRAq1k8SPxVLZ7VTiQ:fsNwmw/0vNC6q3QxVNZTiQ
MD5:	AA59601BD9601B9B3F4DD7B10948B6A9
SHA1:	A5E276371372204B4E5DFB1B778213CD276D37C7
SHA-256:	BABA91D37BD790860A474665C9C8F50A0BDEB2AC74B62A47B2FF3A1B2E0B30B0
SHA-512:	F7956CDB7B25A03F2302B5C258F8E067EACC9BD1BD2A7112E6408817BBBC81D513992B577BDD68DF7C123E1D0CC5119AE8EE74DF884239007CBE0D4A002930FE
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8470553113783934
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxdxl9Il8unTelq30cCZYJwzer+6ed1rc:mIYVUg0VYJEeH1
MD5:	4EA328B3DE9971C6876E87CEF988D608
SHA1:	8417E3E2FA4097587E90F11E7F854F63AB07F96F
SHA-256:	76D2F22387307891ACF18FB493C3CC35CE415B3464AA054E3DA00543EE3CB4B2
SHA-512:	357E357585F1F5E69892206CF5FE6E848D9F7E00148071E2DB944A7B954B67F3FBAB3B73D40B68F0E7950AB947A5F2B33E654F00FBBF57E4D1A98180B34AA3DB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.D.W.c.C.H.P.+.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.o.J.1.c.W.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000313411692794
Encrypted:	false
SSDEEP:	96:GYVAbn8ZMjIHGYYWyx9gimhTQOrkAd/y3+9lF69QcSahBW:GTnRjIHGHW6vUQYH9lF69rBW
MD5:	59A423384C319031A9E3F2067284767D
SHA1:	127EF7C053BDDFDF2A3C3831623FAFAF4D7A0F84
SHA-256:	B3104DA4ADCE0CC2F8BA647DCC627945359130469AF6AD9C3D679296577E833B
SHA-512:	9794CC6A75DB7521702CBC3FF1A937AC5A8BB94A3219BBA6419BC8BFBA6A950E7CE219590B98BABC372DD8AEE8A9FF5979297D8EDA4FA1124FD32332345C5A03
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".h.R.r.Q.7.m.r.+.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.o.J.1.c.W.

C:\Users\user\AppData\Local\Temp\8035834f-a7a1-4848-a136-a165f1d8fe59.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\b3306672-d286-4aad-8819-9434b1de67bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\c4c64b0c-9dae-4a82-af82-2ce84e5324b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5700
Entropy (8bit):	5.880554985014323
Encrypted:	false
SSDEEP:	96:ROI1t7VWFD3F8CRHIaRF9Ngl6PT5jO7a56JYi/GIEQIuB51d:R7t7VWFD3FT3C6PJKHEQIY5f
MD5:	20A872146AA601D3FC29151376104D4D
SHA1:	5DA2B0CA7504193496D27823734967B0927F3BA1
SHA-256:	4E72C4249D8CFED61CD21A330D9116C97BE5D6F1A0A90743A365F62CCCDAFEFE
SHA-512:	73A89EE262DACDBDF8E8FA595165FDAD179A1207AB9A9ABDA3F85582FE008E18BB0B4D9519DB59BB34BE8C31FE3CC83D8AA664C4E628EC3C79651AF874C32182
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJoeXBoLWFzLmh5YiIsInJvb3RfaGFzaCI6InduaE9NeFdLZ0hFMWhROXhKYWZxcS1SeXM4X0hyN2dzZFBBdHBwNmlVUDQifSx7InBhdGgiOiJoeXBoLWJlLmh5YiIsInJvb3RfaGFzaCI6IlpLdnllRTdIQmlLMktnYjBwRUUzVnotRmZ4RlJoQVNQcUJHeXlCbGtkaDAifSx7InBhdGgiOiJoeXBoLWJnLmh5YiIsInJvb3RfaGFzaCI6ImRaUHdPVkNCNC02eTJGRnRFSFJtQ0tfWUpzXzlUbjQzMVRrMm1UMGdDaE0ifSx7InBhdGgiOiJoeXBoLWJuLmh5YiIsInJvb3RfaGFzaCI6InduaE9NeFdLZ0hFMWhROXhKYWZxcS1SeXM4X0hyN2dzZFBBdHBwNmlVUDQifSx7InBhdGgiOiJoeXBoLWN1Lmh5YiIsInJvb3RfaGFzaCI6ImFiWlhPbWx5T0dnSEplVWlHMkhaQURadHA3dlM2QnI3RGh3TUF0eWV4N2sifSx7InBhdGgiOiJoeXBoLWN5Lmh5YiIsInJvb3RfaGFzaCI6Ims5Y1JTUUhCNDNiNlVNaHN6cE5nN3k2cGliTVZGOFJnQjk3MmpQVGNvYkEifSx7InBhdGgiOiJoeXBoLWRhLmh5YiIsInJvb3RfaGFzaCI6IlRMZk92MjdUTFFpSDdWaFNIbDlCblQydDlKSkl1WEpDMWlFWUxRS251bGcifSx7InBhdGgiOiJoeXBoLWRlLTE5MDEuaHliIiwicm9vdF9oYXNoIjoiMHlHekNnc2tpTGI1STJoTC0yc1FCVmJMXzNCekE

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-as.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	703
Entropy (8bit):	4.3052979773855045
Encrypted:	false
SSDEEP:	12:A1/6kZQ0FLwE792NGl5D/0l3gebslEVkGsOoiEbM0TbvZE8h:QnFR0NGlN/0l3g8qfOMbNTbZE8h
MD5:	8961FDD3DB036DD43002659A4E4A7365
SHA1:	7B2FA321D50D5417E6C8D48145E86D15B7FF8321
SHA-256:	C2784E33158A807135850F7125A7EAABE472B3CFC7AFB82C74F02DA69EA250FE
SHA-512:	531ECEC11D296A1AB3FAEB2C7AC619DA9D80C1054A2CCEE8A5A0CD996346FEA2A2FEE159AC5A8D79B46A764A2AA8E542D6A79D86B3D7DDA461E41B19C9BEBE92
Malicious:	false
Preview:	hy.b........@...............H.....L...L...L..(L..0L..8L..@L..HL..PL..XL..`L..xL...L...L...L...L...L...L...L...L...L...L...L...L...L...L...M...M...M...M.. M. (M.!0M."8M.#@M.$PM.%XM.&`M.'hM.(pM.)xM..M.+.M.,.M.-.M...M./.M.0.M.1.M.2.M.3.M.4.N.5.N.6.N.7.N.8 N.98N.:@N.;XN.<`N.=hN.>pN.?.N.@.N.A.N.B.N.C.O.D.O.E.O.F.O.G`..Hh...............?......N........@...............A.......................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...................................................................@...A...B...................G...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-be.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6098
Entropy (8bit):	3.681934272069777
Encrypted:	false
SSDEEP:	96:mmfvnESaDPq1iYM7N8gyurprJr/P5FwBlh/RT95vtEUnbpwROaQPP/KV2L+HCdYV:XfYPq1iYyNk5p50OwQPP/KV2L+HCinCO
MD5:	087DE134F3B23A9944AFD711A9667A0B
SHA1:	1B67D0A65EF91295207D66E62B682803AA74EF00
SHA-256:	25B7CFA039F82AC92990E1789DE40988D490DB9B613852FB24036B38FF87893C
SHA-512:	42C0B51E0E28109A7058D3FC03FA7BEF8B25C9B3C8BB74933574FAD06C061FD1636B53EEEACF652E438D4DF08002DB449681BE9E6E6821EC23D32A8BE1778998
Malicious:	false
Preview:	hy.b........4...(...........E....8...h..!. ."0 .#p ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ...!...!...!...!.. !..(!..0!..8!..@!..X!..`!..h!..p!. x!...!...!...!...!...!...!...!...!...!...!...!...!...!...!...!..."..."..."...".. "..("..0"..8"..@"..X"..`"..h"..p". x".!.".".".#.".$.$.$.$.........?...............w...@........................!...+...3.... ..;..KD&.. ..ML4.NT8.O\6..e....$..m...v2..~<..,..."..:..0....(........S2.......... ...!...".... ......".........................................................S............$..............Z............9.......................$.......".........................................................S............$..............Z............O.......................$..........A...B........P..E[..FK..GK..HK......JK..KK......MK...c..OK..PK...X..RK..SK...2..UK..H:..WK..XK..YK..ZK..[K.......V..MX..........A...B.......dK..EK..F[..GK..HK..E0..JK..KK..H..MK..NK..OK..PK......RK..SK..TK..UK..K0..WK..XK..YK..ZK..[K..S^...V...]..T0..

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-bg.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3467
Entropy (8bit):	2.7535319237657605
Encrypted:	false
SSDEEP:	96:Op0nEURURUxURURU/ajyRUK0x0x0x0xGURURURURURUMO+L:y08D8+L
MD5:	E8A4F8F5238F9A0FF6968AD8DBA2755F
SHA1:	ABF002FF28B3AA2A59948225E5E600096348CAA7
SHA-256:	7593F0395081E3EEB2D8516D10746608AFD826CFFD4E7E37D53936993D200A13
SHA-512:	B54811E1BE6E63BF19E408AC4AE9DA86E1473E4E8F1E9D517D907E025BE20FA6979517339EC6DEFD0EC30613ED42A97D88111D39297214AFA7606597CBA5EA86
Malicious:	false
Preview:	hy.b........d...H...............P.......................................................................................3........U......c...$..............h....U..*.... ...$..m(...,...U.../...3..r7..3;...U...>...B..wF..8....M...Q...U..\|U.......U..#....U.......U..g...h...$T..ET...V..H....U...U..sV...V.......Y..rV..sV..PT......RU...U..Y.......b...C...D...E.......G...H.......J...K...L...M...N.......P...Q...R...S.......U...V...W...X...Y...Z......................B...c...D...E.......G...H.......J...K...L...M...N.......P...Q...R...S.......U...V...W...X...Y...Z......................B...C...d...E.......G...H.......J...K...L...M...N.......P...Q...R...S.......U...V...W...X...Y...Z......................B...C...D...e.......'...H.......J...K...L...M...N.......P...Q...R...S.......U...V...W...X...Y...Z......................B...C...D...E.......g...H.......J...K...L...M...N.......P...Q...R...S.......U...V...W...X...Y...Z......................B...C...D...E.......G...h.......J...K...L...M...N.......

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-bn.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	703
Entropy (8bit):	4.3052979773855045
Encrypted:	false
SSDEEP:	12:A1/6kZQ0FLwE792NGl5D/0l3gebslEVkGsOoiEbM0TbvZE8h:QnFR0NGlN/0l3g8qfOMbNTbZE8h
MD5:	8961FDD3DB036DD43002659A4E4A7365
SHA1:	7B2FA321D50D5417E6C8D48145E86D15B7FF8321
SHA-256:	C2784E33158A807135850F7125A7EAABE472B3CFC7AFB82C74F02DA69EA250FE
SHA-512:	531ECEC11D296A1AB3FAEB2C7AC619DA9D80C1054A2CCEE8A5A0CD996346FEA2A2FEE159AC5A8D79B46A764A2AA8E542D6A79D86B3D7DDA461E41B19C9BEBE92
Malicious:	false
Preview:	hy.b........@...............H.....L...L...L..(L..0L..8L..@L..HL..PL..XL..`L..xL...L...L...L...L...L...L...L...L...L...L...L...L...L...L...M...M...M...M.. M. (M.!0M."8M.#@M.$PM.%XM.&`M.'hM.(pM.)xM..M.+.M.,.M.-.M...M./.M.0.M.1.M.2.M.3.M.4.N.5.N.6.N.7.N.8 N.98N.:@N.;XN.<`N.=hN.>pN.?.N.@.N.A.N.B.N.C.O.D.O.E.O.F.O.G`..Hh...............?......N........@...............A.......................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...................................................................@...A...B...................G...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-cu.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	52842
Entropy (8bit):	5.38329333122688
Encrypted:	false
SSDEEP:	1536:a5OMYzUXoeoZA7SmEUbxucj5DTKZ2oVXEyb:a5JYzUXoeCA7SmEU9ucjBKZxJEyb
MD5:	B4E5921B1DF85BA9F2EBE6CE578915F6
SHA1:	B5F2E813667AAE32E65CAB9C9A0DD291421ADA0B
SHA-256:	2BAEE19D5024FF87DCF3A1B9D0DA1B3AC5A1E506ADEEAD3B96A4DE5395D0290E
SHA-512:	41696A9E25CA004ACDC8DEF265766392CE3568747560FF73CD08AC9FA4A99E4C4654FB84DC602845B3E444A8312FB099C72932471F7E830874CD7CFA184B63B7
Malicious:	false
Preview:	hy.b............4...j....................0...8...@...x..........(. .). .* .+( .,0 .-8 ..h ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ...!...!...!...!.. !..(!..0!. 8!.!@!."H!.#P!.$X!.%`!.&h!.'p!...!...!...!...!...!...!...!...!...!...!...!...!...!...!...!...!..."..."..."...".. "..("..0". 8".!@"."H".#P".$X".%`".&h".'p".(.".)."..".+.".,.".-."..."./.#./.#.0.#.0.#.10#.18#.2p#.2x#.3.#.3.#.4.#.4.#.5.#.5.#.6.#.6.#.7.#.7.#.8.#.8.#.9.#.9.#.:.#.:.#.;.$.<0$.=8$.>.&.>.&.? '.?('.@0'.@8'.A`'.Ah'.B.'.B.'.C.'.C.'.D...E0..F.o.G.o.H.o.I.o.J o.K(o.L0o.M8o.N@o.OHo.PPo.QXo.R`o.Sho.Tpo.Uxo.V.o.W.o.X.o.Y.o.Z.o.[.o.\.o.].o.^.o._.o.`.o.a.o.b.o.c.o.d.o.e.o.fxq.gP2.gX2.h`2.hh2.i.2.i.2.j.3.k.3.l.3.m.3.n.3.o.3.p.3.q.3.r.3.s.3.t.3.u.3.v0..wp..xx.......................2...8...U...h...........B........ ..................A..:...i........a..........H..._b..}b..."..."......"...BC..Z.......q...$....C...c.!.....C.#D`.$.c.%U..&..'-..(S..)S..g$.+L..,...-.D..[....d...E..L...QA.3e .4...5.e.....7...8...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-cy.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35913
Entropy (8bit):	5.348760037769152
Encrypted:	false
SSDEEP:	768:s022NAK9/8ei2v0BJlYZqNCII2vfP+DzEKd8mPBFDpvH5aWg6:c25X/MBPjNCIISkTPB3RN
MD5:	B0F32ED7B4B8A068A962D820627B7229
SHA1:	76734E58BD33C4D1450228BF05E53CFE169A02E6
SHA-256:	4D0569FE2F4B41B3164CF610310E1D996FD2C553CC39DE6062E50F4E033CC207
SHA-512:	8F20253985C217401627E0C7D31AA1BF213FA220BB498869E11E1E532C3C82DBC2ABE6FFA27C69243913243AF1AEB35806175511D77D730C914B1CADD71AA7A0
Malicious:	false
Preview:	hy.b............(...I.......A...................................................................................................................................................................................................................."..@.......".....H.D...e.................... .. 0.,#...&...)...+....0.11..R4...6..T9............[.....y........; ..<...=H..>..E@..&A...A..HC(.).@..C`.+Ex.LF..MG0...../?8.0H8.QH....p..H..TJ......bK...L...N...Oh..Q...S....@.i.H.JVp..X..L[P.M.X..]8./`...b..QeX.2.x.Sh...j........{...h..l.......x.C3...n...Hh.....O. ..pp...@.o\(.p....\|8.rq..sr...t...v....X.!.....X.%eh.........Hx@.IT...t.......'`..z...../{..0.(.Q\|....H..^p..~......!.......!.d.$........@.'Np..% .I.X.j}..+R.....M.......o.x.........2.0.....T...0.....P.s/..E8.........b.......$.P.%...F...G.`.H(.....J. .....,.h...(...8./.H...0.q..............a........1....X................i......'....................X.1)..Rd..s.......1...4.[..;..e/..........B........-......&3....[.............t.......

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-da.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6967
Entropy (8bit):	4.538486676934439
Encrypted:	false
SSDEEP:	96:op8RuPmWKvTES4MDmKQS3mAdi1flBiLwHR08fiCkUNGrvYe4KiGn1BUBkQH:op8ImWKEGS87diLBiLUfoUNGrln1BUBL
MD5:	D0E160DCA547EDA390D6CC7C4A1F7AC6
SHA1:	7EB71819675E82B1BB92428E07FA6B05CD1854D8
SHA-256:	86FDFC8DB62CDAA11F615DAD3712DA1F4708294E029A4AAD0FC285D4EA16C4BD
SHA-512:	9BE5F673962C6049ED1C796A81AA7BE72A1C7715FC2D4610CF6565541C7BB145D068B94B5FDADD30BDB5F5287CCC2055EC1DC9E11E4C5B8965D59EF73AB145C4
Malicious:	false
Preview:	hy.b................7.......A...................................................................................................................................................................................................................A.......!.<.......-.....e.3...:.........i...* ..+!&..$...(2..+".O/..P25.Q.9..54.s9;..=/..?..VB%......i)..D....*.[G...I,..K..a...".....0.D.1...6.E...E...............................o..... .e.....#.3.......)}............'.y.(...............7.B.......$............L$...!...+.....k@..lN..M.......o...0-..e...RH...O..TQ..!................!..z......6.................................l...R....E..t...U...3...w.......................D....2..............................................=....M...R...T..u..............Y.......s...\...]....U...........V.......(..g%..............kW..LY...$..NP...X..........2[......T]...R..6_......x...........{........2......!.......%...........................L..........o.......l.......S...._..........U.......Y.......E...\...]...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-de-1901.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	121393
Entropy (8bit):	5.614356663048744
Encrypted:	false
SSDEEP:	1536:4S0havr6N41g38Gnzvueua0+Az+u3tnQrI9LKyQh9HzSWwwwKYf+wBuLxfrHmu:5cae4TyzvqaQzjQMuSWwwU+RpT
MD5:	DD9D0A81D897F88F76C1F6D69FB7483E
SHA1:	520BF6111F902196591EA358FA8AB4AE89EE0ACC
SHA-256:	8C5FA4B29519D17593E923BC6A9A284DF7A6D07FAC42F897110B8FB2E0BAEEF5
SHA-512:	8C0A339D353CAC1C66542BCFB7D41E7241A59A1886FE8A189AA155AAFDF3BD23274F956D3D8A49BE5B23CCEAFB516648A0E0B44F67E6F5CA60E216FB3F362CCC
Malicious:	false
Preview:	hy.b........p...P...1.......T................ ...(...0...8...@...H...P...X...`...h...p...x........................................................... ...(...0...8...@...H...P...X...`...h...p...x........................................................... .. 8..!@.."H..#P..$X..%h..&...'...(...)....................... .. 8..!@.."H..#P..$X..%h..&...'...(...)..............?...............rs............@.....2@..=.#.G.$.R...\@'.g.(.m.-.r /.}@(.../...0...... .. 7.......8.....@...`9...... .Y..=..a<..!=......@8......3.O..!. .......%.....%...f...g....O@..!..j(....A..4A...`.D4...8a!..#.=.$H%.%.@..J..%.D...>.'M8`)NI...J...Na&...).QA .S...V..Y.....,.\a%.........^...O...O.-.'..OP.......O@/.a/.....e...../B([0...HO@..w.2...0j....a...f...oA3Dt.4.ya4.}!5.A.H.A.I..6...7...7..!8.....!:.V.-.....:.2...:S.A....2...:.........&.;.n!.Za.[,......m...c=.O...O..A..&.."...x......m..O\..E.....9...@..U.........C. .........9...&@.... I. J.. K..!L.."..@#.&.#..!$.....U....!....'..!...!(.U`(.Y.....(.$..

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-de-1996.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120412
Entropy (8bit):	5.625930999317145
Encrypted:	false
SSDEEP:	3072:+GQAdd4u8VlGiVdYQvi792ovhcxX9iEaAGGceTUjnnfxXElEg:7Q+UfN3RiEaZGceTUjnJXih
MD5:	E7A9906B316D478B55BF8EBCBBB1D1C5
SHA1:	5688453DE9AFB7405960980DC93ADF9296AA2F4A
SHA-256:	D673805547A0228D2F57A5AD551B8760CFCC521F38C49284ED3976E3515BCA49
SHA-512:	36E6BEABA33A16203F996D6E8FD987347028D590A4B4BCD4D2A129876C486E03B9BA13F279F301E91AEC1E0F8E91BF109A27F2B464F15A3E1A2B56D03473B69C
Malicious:	false
Preview:	hy.b........p...L...\.......T................ ...(...0...8...@...H...P...X...`...h...p...x........................................................... ...(...0...8...@...H...P...X...`...h...p...x........................................................... .. 8..!@.."H..#P..$X..%h..&...'...(...)....................... .. 8..!@.."H..#P..$X..%h..&...'...(...)..............?...............qr................'.4`;.>.#.I.'.S...^.,.h`..n...t.0.~.3..`9..@..../.. +.. <......`....... >..@>..>..`.Y.@....4..A..............A.NT..!.`.........$...%.....-.....TT...%..j,...2!..8. ..` ..!.;.#...$.Aa%H%@%.B.%..`&.6A.LCa'.G...I...M.(PJ..CT@).O...Sa..V...Y....*.\..X...Y.`$.^.,MT.(NT@.PT..LT %....RT@/.p./.H!.....A.....[0B..0E%...].0.%`......bA2BgA..pa/.t...z...~..G....!5.a5J..5..A6..!.M..$.....8.6...).p.7..A.S.8....U..9. A$..@;./..Yo.,Z.a3....AD.).."...x<_T.;`T@.Mr =..B=......`...83.#.;.hB..A...V.=jZ..A..>B..>CZ.../ ...a.F....&..H.@...!...@.K......MZ. .&. O.!.. "QZ....A"..."..!!....VZ.#W]..A..$.#..

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-de-ch-1901.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120218
Entropy (8bit):	5.59374839547232
Encrypted:	false
SSDEEP:	3072:iDCOweCoHgtKmiQaf6ZCM1BKstDcqZnSmEBQBkXmhHB71:CCZeLHgtlG6dzhcqZnSmjkXmJ
MD5:	C6773229845710633D3A4D6DD9800FC5
SHA1:	1D4C2E5F3DDF5627164EDB471E8A8177993449F4
SHA-256:	8223A912160354E05735522FDB339DC59B353AD5D1E4F4CFA94898DC348E748F
SHA-512:	EA69926520429CD934D52D84A7FCAD6BC9BB654085D8D1DE813E73F191EBD7B310E2E68B4BB43FECBD88CFD15EAD7FE295405C01B7FDC225914B0477C08D4E01
Malicious:	false
Preview:	hy.b........p...(...........T................ ...(...0...8...@...H...P...X...`...h...p...x........................................................... ...(...0...8...@...H...P...X...`...h...p...x........................................................... .. 8..!@.."H..#P..$X..%h..&...'...(...)....................... .. 8..!@.."H..#P..$X..%h..&...'...(...)..............?...............hr...............`8.2...=.".G.&.R...\ (.g.,.m...r.'.}........ &..@...@)...6.......6..........-......:Y..;...7..!......@2..h.....NM..!.....A..,E.d...%. .f...g.@.LM`..!..j(.......4. ..."D4A$.8.%.. %.=.&H%.(.@.%J..).D...>a.M8..G..OI..PMA....+.P.$SR...T...YA....,.[.-.........^!.MM@.NM`.R0a..M /..`.RM.-........A>..L.0..z....0.L..........j....a.2.f...o!3Dt.3.y...}...a5H.a6I..6...6..A8...+.....a1.V.8....O<.....1..!8......#.........& ..Ga.ZA;[,@...B&.j.._s.._M..`M .A.8.R.B......K..E.....B...8.Oh.... .S..........C.......... F.. .. !...!I.A"...#K. #L.a#.S ..&........'.S.'..a(........U....S.(.U..A+...$ .

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-en-gb.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46607
Entropy (8bit):	5.538023038233528
Encrypted:	false
SSDEEP:	768:8CPGXSlQXvRVYVL0xpPuB5YBBaEiQD6m8eft0Sr+uh0d3TPwHh8fJVVoxUb:8bXQMZQ0xwB5Y7aEiQD6mPf2S6uoTPwg
MD5:	FA3DCB77293A058277CB148A0FF491FA
SHA1:	3335315B13CD82075DA2ADBEBE32759C01833E8D
SHA-256:	AE4B78009D18E849D87458677151EE3AAD1608AD72EC050DFD2421D22E7D031F
SHA-512:	C83A8C4EB29C3171FEFE983C3E342B6AF1BC1ADD7288C75C5A782DC14F12D2AF83043C2B43C9AB3E5DB61C91DE6D7CB473746517DEBCFF7AC2C0F05BB8B0971C
Malicious:	false
Preview:	hy.b........`..............A...{....................................................................................,..@.....`...p.........%.h.f.H...h.H...i.@.."X.K%X.l(H..+....`..2..P5......r8P..;...>...B...D(..G..8K..YN..:Q..AT8..Wh.CW...J...Y...\X......\...Q........(..]p.-_..._..Ob...e..i.(.."8.sgH..h@..Cp.."..W.......U...........Bk(..k0.$n...oH..`X..q...c...s..J.......,v0..x..Ny......0\|@......~ .....4...5.P..#...e(.x...Ys`.:W...............+..e...&......h.X.i.p.....+...,F...E....@.O....C....... ..h...........h.W.....@..i..cK...vE.e.0..R........P..`..C..KQ....!.@...e./........P...h...X.4...U...u.(........9.........x.....C....H.........Ga....`...H.................N..........y.......D.... ......%8...H..R..Y................X.$....x... .....h[P.I.`...x..i..............8....q...R...........U...6.0.wp...g..9. .:L..!.@."......$.8.%...{P....(........Q.hv.......L.....O.......o.(.r...s.h..U..U................p...(... .Gv0....i.....b.of....H.......P.......8...(.....$@.

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-en-us.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	59802
Entropy (8bit):	5.854267250388292
Encrypted:	false
SSDEEP:	1536:h5tXyt+U07SAFarfxlLXSwk1cI3P05j23Kqo74TKAqs:JCtYuPrfxZE1c0o26aT9qs
MD5:	B2693233D14890C81D322BEC948549E7
SHA1:	7EA8E42E319305010D3E6568FB4983171583DD06
SHA-256:	03727CD6F4AA71B203C4C74CA6987AC7D87F13037337AC6F4B6996C2A0DC5F8C
SHA-512:	1BCB5A9C3DB408FBA6A6D02162A294C5C7264D4B202EB332DA8D02C0C662CB070CF1534D5AA0754788D35ABC88273F3337CA5F302ADA95BCAD077EAA52804915
Malicious:	false
Preview:	hy.b........`...............A...{....................................................................................3..@...a.8...............h...h.......x.....J"X.."...%`..(...+.../..02..q....5..38..T;p..>..VA...B..xE@.yHH..J..!MX..P..CP...R..EU...X ..X...ZP.)[h..Ep..]...]p.M_...`...a...d.......d@.SgP..i..U@...j..7l..X.......:....mP..Th.do........`.Gq..(P...L..J.......,s...m...t....(..v.......y ..\|..4}......V[......8...."..Z...!. .b10.U\|....8............(.@.....J............x...8...........@..........'H...`.V...7...a.....8..!`......`.........H.......r.q.....l...E...N.x......F..Q.......3.@..^P..H..\1.EA..ob..........a...B...C.X...........(.G.x.......0.J..... .Lv..M...n.../...P.0.).h..8..Hh.T.i....V...W...ebs.y........R..#. .d........j....@.(........P.+B...H....N....x... .....2.X..0.................X.(..L..!.P."..............WH.I.(...8...p...)..0...O...........Dx.0.....@.2jh.S...t<..U...S...a...".........@....z....oP..]..i... ....`..l...........O.p.0....U....0.s...4tC...P.

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-es.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	14995
Entropy (8bit):	5.189941208174841
Encrypted:	false
SSDEEP:	192:j6aP1LZOFTlMa6Xb05w4rsv6SHyg8jNIcG3VTCkde7QpCKBz1iBOJGPJ3IDIHmz:hP9er5wKGhSfhIc4yyC+z1iM0PtIDIHQ
MD5:	F6BD0377237FCA3C4B7C6A6CB244298B
SHA1:	B8DF975889CFB06FC97DB3D63A7820B7CF621F40
SHA-256:	137461792537A2E56A6475E81E2B9AD7A2BDABF1F4738FAE186DCA3022357349
SHA-512:	0A36860580E295122F5E49091127386EDC762EEDBA80A2D7AD958AB33307AABCD420173E08AE797A19664BC830800D92C548F3E434BF19BFD7791E50E0C45C2A
Malicious:	false
Preview:	hy.b............T7...:......A................................................................................................................................................................ ............................... ......?.............................$.C...."8..((../,..6d.H=...C@.JH,..OD..U0..\,.Nc...j...o0..u<..\|..S.....L..........\.X.T...@..l..........8..........0..........(...'..F...G.....\.I.D.J.X.K.4.L.4..8.N.......PBp.Q.h...p.. H..E..N'm.V...W...X...Y...Z.<.....A-L......E....4.E...Fh....m../....x..:....`.LE...I....<..\|.....N8........ ..}X......@...........)....t...T.......$...D.G...H.....\|.......H...Q.M.(.....U.@...e...........p.T.........................x.....A.....P....... ..j....(.G.T......R............Y.M.....H..#..........R.........x.......`...P.................S...............E......G...H...O.....L....... .M........+........t...i.....T.../....d........................E.%.....D....)...........8......./....a..M.....NO\......t.I.h.........2.................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-et.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	21421
Entropy (8bit):	5.229662639498423
Encrypted:	false
SSDEEP:	384:1HSUqMAZs9xsrscHJvMC0rWxMabdxhDPWSZuVyVm44/DasJVwLf3:1YanasivMaMaZxFPWSZ+EaZVwT3
MD5:	2AE42AB807286F6EC0FF1876D9536B0B
SHA1:	CF3BBE7348EAF2CB3D93C5CC10964BB8D1BA07C1
SHA-256:	10079C66014DD2E6ABFEF5A018E6553FD5A036AFB96BD2A235440A188F88B15E
SHA-512:	13C193571A7374BB169F6F0F06A9AF7F8251CFCBF60825A85396C907D40F7837C8EFD0A7BC8B6C4DEED2BFCA7B8508F132932D7860C2C9A4FB568D8BA2ACAEA9
Malicious:	false
Preview:	hy.b........d...dQ...S......A...............................................................................................................................................................................................................................................................................................................................................................`...........c...........f...............j ...#...& .MP..-t..0..04\|..7...:l.S>...A.......DT.7G...J..9M..zO...Q...S..N.......D....p..f.....$...8...`.JU<..MH.l.T.mP....`...<..Sx..V...W..S...40..A...v.4..........U..aY...[...[...^t.e.@..\@.gW...aX..^...b..keh..f,.-i...j...l$..n..qqH..r..std..@..6.\|...,.......d...P.:........vD..........xh...\.8. ......y........D..Dx...0.......p...0...(.1........`.......{4."........}............X...\.....j...KI..LP......n\....L.PL8.."..r....a......A........%..d....E...)......A..."......d...%....P...h..h...........K....f..-z.......+......q.......3...T0......................:....O......

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-eu.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	665
Entropy (8bit):	2.439677624130323
Encrypted:	false
SSDEEP:	6:k/8uq10tX2q10tXFtXe8lLLmfllGjpLtwaISjQFytGtq5AlNytFl/r8IYMVnnn:Wq1092q109nuf/GgaISDGE6wfj/Nn
MD5:	E90EA97070CFCFA795FBD807AC300D34
SHA1:	8C83B4CD54D394AEFF31B14A219F2A3562132908
SHA-256:	E2778A4FC7B8F064A32B6A44BC29F10E264D9D6214B8EDB8EBD1F5F6D68E2EB2
SHA-512:	210DD857F7799F1A926C7AA73F26912AD60723E099ACF1566BC39EFD445A1B194BE4DC557D5DA6874E7D75A37115AEAD9389B8009EEC1422764E6648FE4CF8F1
Malicious:	false
Preview:	hy.b............t...........A...............................................................................................................................................................................................................a...........b#..C....3......f...g.......I...j...K...L...M.......o...P...........3.......U...V...W...X...Y...Z...!...!...!.......%...%...%...(...(...(.......................................4...4...4...!...!...!.......%...%...%...(...(...(.......................................t...4...4...A...............E...........H.......................N.......................T................................... ............. ... ..........

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-fr.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8165
Entropy (8bit):	5.160239303629025
Encrypted:	false
SSDEEP:	192:Yq67m0o5PsoVQ5rT1+Eqy2G0Xy7i6uccc/J66POIY2:YHmkeQ/1v2Gay7Bupcx3vh
MD5:	092E0A95D6DADA26CA56D2ED558749A3
SHA1:	40BD8296E5E852FE725C7119083A8D5614037CF9
SHA-256:	00BD8B2D398D77575DA2BFBBC5EC641AAD7F2A87D4A31186EC169E85A27DE5B7
SHA-512:	C04BA62F4A0336E9B25BD2F6A8C3CB82C8B6127C1C04FC173ABC9BF03767A9FFE18C9241B301D6F71F79F3377BC990F25F099D7660880C097A9CF4BB1E4BD48F
Malicious:	false
Preview:	hy.b........P...`...........L....8............... ...(...0...8...@...H...P...X...`...h...p...x........................................................... ...(...0...8...@...H...P...X...`...h...p...x.......................................................8.. @..!H.."P..#p..$x..%...&............8.. @..!H.."P..#p..$x..%...&...'...'...........?...............>.........@...&.......Z..'2.F10......9...A...Jz.KPB.....MTV..\...d...m...v...{$...`...b.....V.....:...*..'....H.[.......Wh...1...6. ...a...G.......u..%.K.........E.x..$~.G.<...}.......\...f..r........D.O8.......,>...d.Ur........X...N.....O\|..J..... ...^.....P..... .........!............0...T.........G.j..8...L..IR..........=P..x...........,....n.......t.P..... ..."..p.Q.....r...,...(...5...8...F.................V...........D3.....................C........p...z...!.......1......................C.......X&..W...............E&..K....f...S...q.........Q............X .Pl......W........@..U"..[.......X&..^.......`...a...b...c...K...e...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-ga.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35824
Entropy (8bit):	5.524309158837039
Encrypted:	false
SSDEEP:	768:eZAG7bymjpz7qBZWBHn7xbeGhs0fCJRc3uQz3sfLsCPI2th4k/:iAGfJjpn2UbxbHhJaLc3pcfLFP/4S
MD5:	768032A419E0AE3BD870D591E2173715
SHA1:	58FD709A1DC40176FB72189C20567AC1950B9DB7
SHA-256:	1E3043F395BFB2A4C43D0480BA2F168ED622881CC3482359CA6E99821E983BE8
SHA-512:	4A4CA1F735B82F625002B0292F623179F2A6CE736F633CBFD6868E3DB0709EB06EB462BD9DA3FFA8365C3C38FDACBA735AD32266CB3EC33D3E583ED073D0E3AA
Malicious:	false
Preview:	hy.b.......................A.......................................................................................................................................................................................................................y!............P.c.0.....e.0...P...x......"(..%H..)...,.../ .N2...5@.P9...<..R@...B...s..u.8.h.....8..E@.YI...K...O...R...U...W8...p.dWx.%....Y...D..HZX..]..j_...Y@..[@.._h......`...c..Qe...e8.j. ...0.O.P...X.8.`.x#h.........[...\|J...gp..h..dlX..A8.&m..'p...+...s..uP..w..L{...~..............Q.P.....S...!.....I.....k...............c.X.dB...PH......P...h.........A.!.,.H..c...F..O.....h..4h..p..)d ...(..<a.......q..L.......S...k..\|....P...{..3...P...y.......P+.(.0.i...........L.....@...x.O.....H..G`...X.....a.a.)........&............(.;....M..!...............e.....................(.......x.....A.........Q...r....q..;q.......\|......8...Y(.:...{....g..a....P..........!.....8.....9...i.p..mp..20...X.-....x)...p.pr....h.(.p......)..h....\....x.8...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-gu.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	655
Entropy (8bit):	4.207284085511268
Encrypted:	false
SSDEEP:	12:Kphl9dsn8tHcgWQZXiJhUmN+tRktU9t80dtcUdH0TME8h:yhl/3HRWQZXifU6+EtU88yJTt8h
MD5:	F6DC4E0FB974869D3D9457C582A38690
SHA1:	E6708AFA342639EB96CB97D1F541A421B2626D00
SHA-256:	AF0EDB67C2219B803C3EB6C1DEE6F2D41A3FE00468A9DA8BE8EF5056D701ABF3
SHA-512:	A778236FA8C5F28E747214D0BA0417ACA1C9A95E4C013FBC21E6DEFE39D0421A2B27CCB27E6F248404A9F6B5CD1014574D0478078F36AF2A0181872AC8173D72
Malicious:	false
Preview:	hy.b........(...`...........B.....T...T...T..(T..0T..8T..@T..HT..PT..XT..xT...T...T...T...T...T...T...T...T...T...T...T...T...T...T...U...U...U...U.. U..(U. 0U.!8U."@U.#PU.$XU.%`U.&hU.'pU.(xU.).U.*.U.+.U.,.U.-.U...U./.U.0.U.1.U.2.U.3.U.4.V.5.V.6.V.7.V.8 V.98V.:@V.;XV.<`V.=hV.>.W.?.W.@.W.A`..Bh...............?......H............B...........A..............................................................................................................................................................................1...............................................................A...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-hi.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	687
Entropy (8bit):	4.239578871898771
Encrypted:	false
SSDEEP:	12:abdtltF8MN32m0c2SSYuNuA4vltG9qXLgskIU9t80dtcUe0EZA8h:aptKEGC3F4IU88yMUA8h
MD5:	0807CF29FC4C5D7D87C1689EB2E0BAAA
SHA1:	D0914FB069469D47A36D339CA70164253FCCF022
SHA-256:	F4DF224D459FD111698DD5A13613C5BBF0ED11F04278D60230D028010EAC0C42
SHA-512:	5324FD47C94F5804BFA1AA6DF952949915896A3FC77DCCAED0EEFFEAFE995CE087FAEF035AECEA6B4C864A16AD32DE00055F55260AF974F2C41AFFF14DCE00F3
Malicious:	false
Preview:	hy.b........8...............F.....H...H...H..(H..0H..8H..@H..HH..PH..XH..`H..xH...H...H...H...H...H...H...H...H...H...H...H...H...H...H...I...I...I...I.. I. (I.!0I."8I.#@I.$PI.%XI.&`I.'hI.(pI.)xI.*.I.+.I.,.I.-.I...I./.I.0.I.1.I.2.I.3.I.4.I.5.J.6.J.7.J.8.J.9 J.:8J.;@J.<XJ.=`J.>hJ.?.J.@.J.A.K.B.K.C.K.D.K.E`..Fh...............?......L............A...........A..................................................................................................................................................................................2...................................................?...@...................E...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-hr.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3031
Entropy (8bit):	3.198992736743913
Encrypted:	false
SSDEEP:	48:d2CEMwYhky3FiH3wJVNkSghtchN/LPbmqfjUdesNmw:uUDdk7wXYEw
MD5:	1864E47E724BB7F9C052A2840EEE21D9
SHA1:	9749136107913D6570C0C46AE2B52E66D8284C38
SHA-256:	D5F066A5657F1D7C39D053956DF204B7926F40D2FE4F69573AF09D909066E26C
SHA-512:	2D6E76AED93652510F5864DDE1E1923C67E7413E895ABFA8FC7E8C9177E228E4D153AFB7099B86697D1662CA3124FF2173F4AAB2C978D52583A8E2DBC70C0842
Malicious:	false
Preview:	hy.b........d...p...........A...........................................................................................................................................................................................................................................................................................................................................................}...@............2.......%...2...........%.....k................%..p..........3"...%...(...,..W/...2...2...5...9..........R...............V.......E...g................................................................"... ...........:...........;.......................=..................................................."..%...........2;......................................................................................."..............r........................................................................@..............."..-..................;-.........................................................-..........

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-hu.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	317251
Entropy (8bit):	5.519807782240349
Encrypted:	false
SSDEEP:	6144:wxOMr0dBjIg2U0RT7c25PkvQoc6yzRcOmpTeIrDh2ky5khBh13kwTbqgT3Gfhh4D:wvkufNkzFtuWlAh36
MD5:	37B1F197E8DFBAFDAC4597EDCF673E63
SHA1:	E672C6870417C71ACDCDA6C16A7185D7A868EB68
SHA-256:	8B3A16268CC932B226C17FF405B3CFB6EB38A9511A2043D653DC03729EFCEAC1
SHA-512:	69EE820439633B348BF8EFDD3C498A30270753E53FF78D022BD1B295C6C95E0501955009F610A12FC55C786A563B0AF40D2B69A7584B47662B943ACBAC2D3634
Malicious:	false
Preview:	hy.b........X...D...C.......A...r........................................................................................................................................................ ...!."......................... ...!."...................................................................................##..............................$$.......?...............u4......A../...6.$.A...FE7.3.@.O.I.P.S.SI\.R.e...n.S.x.TM..<...4..X...YQ..1...F..-...>U.. .....C...Y..M...N.......1...5^..;...D.'."!1."b:.E.C.E.L...U...X.....G.Y.G.].I.b.B.c.@.e.J.j.K.].N.n.J.r...v.).i.U...T.z.U./.6...Z...L...ZU..WV..+./.../.>./.?.{.D...%...7]..K...._.I`f.Y!T.M...@#..,........A.....(...5D......9...C.......H...&J..)K..P..3...R...V...V...#R.....O...9.&..U/.V4.+.'...9..Y.-.?..[G.<E\.2.K...O.._T./.Y...H.Y.$c...$7......A`...g.B.R...V.,.p.?.Y...-..Yy...y................7S..=....P&.0.....L.....%.B.8...#V...Td...........L......c..]..A.Z....Q`....r.(...&.A.=.$.......:.;.2.....O.....:.?........!........

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-hy.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	605
Entropy (8bit):	2.7480544370803566
Encrypted:	false
SSDEEP:	12:6q103+54v4Oq103+54v4At/tJBb3ANmWLYC926DXXc:B+Omvo+Omvn/tJJ89248
MD5:	70EA4451C3A26FD7197A3D2188BE4152
SHA1:	E0C1390D94876BF2A3CBDECAABB0E335BD86355D
SHA-256:	9B34DFCA85CB27546829F104F137757EFB274934C1E9D4991F55AD564962A76A
SHA-512:	AC957947C51EA23A9B7CA482DB08F0CA3332B8048025A96ACB01A4486C1A87C3F3D08898E94CC8E0B20721C56CE708FB37E1BD81BEE1FEDBA60A7F370D5DDAA4
Malicious:	false
Preview:	hy.b........\|...@...].......1...................................... !."#$.......................................... !."#$.%.....?...............k.......A'...@..........E.......G...H...........K...................................................X...........................B...C...D.......F...d...%...I...J.......L...M...N...O...P...Q...R...S...T...U...V...W.......Y...Z...[...\...]...^..._...`...a...b...c...A...............E.......G...H...........K...................................................X...............................................d..................................................... ..

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-kn.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	711
Entropy (8bit):	4.3179288692537705
Encrypted:	false
SSDEEP:	12:uYYcrpn9wlpnJca6CUARLvXCqngHkGsOoiE9j00uE8h:uYDrp9wDnJca6CUcLvyqNfOM9IA8h
MD5:	D986AC2E7C75CF3EF929A7A269AE0D5A
SHA1:	DE8BF2EE2B8A77102337C45E5FEC924C6C02355B
SHA-256:	2B999D0A152F804601AA8F38FF0D3A6E5949977BF1DAA76FA888ACAE21526287
SHA-512:	5475C82FD5074334BC5F0F89EDAB62E94BC5865DA0432C6F830B50DB3045AFDA12BB698659951F6D0F76C55A43E1ADD8D47AD7FD03597BBE92D8178AD4783C71
Malicious:	false
Preview:	hy.b........D...............I.....d...d..(d..0d..8d..@d..Hd..Pd..Xd..`d..pd..xd...d...d...d...d...d...d...d...d...d...d...d...d...d...d...d...e...e...e...e. e.!(e."0e.#8e.$@e.%Pe.&Xe.'`e.(he.)pe.xe.+.e.,.e.-.e...e./.e.0.e.1.e.2.e.3.e.4.e.5.e.6.e.7.f.8.f.9.f.:.f.; f.<0f.=8f.>@f.?Pf.@Xf.A`f.Bhf.C.f.D.f.E.f.F.g.G.g.H`..Ih...............?......O........@...............A.......................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0...1...2...3.......................................................................E...........H...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-la.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1839
Entropy (8bit):	3.12543324723605
Encrypted:	false
SSDEEP:	24:aPF+sH+sNIemluNLFrqCvmEkzR7PfHcQJk8pAhYx1yRzlF6mi9JgJMppZ+ss:uFt87uNLFr1uh78BSLv4z3icgZjs
MD5:	9AAA47272099A013A4389BC314B7D2ED
SHA1:	20B5BF65FA2023E67EA0687F643B52EAB3FC68E9
SHA-256:	FD4B6F36135CD3B932E350EC2017DFD89D2E36AC226F54E4C8F2E4BC6DB0593D
SHA-512:	318B17B2E2B16EC73F231455D633C69FD44B32868C215053B3CCCA54472E775D4589CBB4DAAD2FE37A40F79B6CDE497F654654BE009D485A84327E0F560FC843
Malicious:	false
Preview:	hy.b........8......./.......A...T....................................................................................................................................................................................................................................................................................................?......Z...@...A.......c...................(...iP.......C...........X...........@..r.......Ta..................9...:.......u...C...........H.......................w.........../...................l...m...n.......".......r............'..............................................................T.......................q...........4%..........H.......U...u...................E.......................................)...........l...m...n.......(.......r.......5....'......................U.......R............................'..............................a...0...........e...4.......l...m...n.../......."...r...o........'..............u...f...................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-ml.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	776
Entropy (8bit):	4.382199613837181
Encrypted:	false
SSDEEP:	12:CJJUUXPF9sMd3MpLuNMaYGakZyqmiK/XwEHsz2ky4NO9xZI02nk9KpJ:CJJ9CHpLnF9H/LsSyNOn2nnpJ
MD5:	84A0A36EA2C5B3209A3CD40D1043230F
SHA1:	A98436B640A8CFB9CFFA26E89FEE768DCE6F0747
SHA-256:	90572DB8F49B01EC6A102732CDF14FC3F07D363CBE0D261103E583043164E888
SHA-512:	845AB7B075D3EC490C477AF3B1F6D28CDC83289D206D079730F69FFD32A0FADB04EB3C9539E4DEE6DAC080489AEA9F3365A20810B4BBB229C2AEA3558BCFA1F5
Malicious:	false
Preview:	hy.b........P...............L.....h...h..(h..0h..8h..@h..Hh..Ph..Xh..`h..ph..xh...h...h...h...h...h...h...h...h...h...h...h...h...h...h...h...i...i...i...i. i.!(i."0i.#8i.$@i.%Pi.&Xi.'`i.(hi.)pi.xi.+.i.,.i.-.i...i./.i.0.i.1.i.2.i.3.i.4.i.5.i.6.i.7.j.8.j.9.j.:.j.;0j.<8j.=@j.>Pj.?Xj.@`j.Ahj.B.j.C.k.D.k.E.k.F.k.G.k.H.k.I.k.J.k.K`..Lh...............?......Y........@...................B...................................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...-......./...0...1...2...3...4...................................................A...............E...F...G...H...I...J.......L...........................L...............................4.....................................0.............

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-mn-cyrl.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5142
Entropy (8bit):	4.03246540989063
Encrypted:	false
SSDEEP:	96:l/PxIafuSv0YHQYYrJ8XFY+qT4uPnjHcMymaH0:lnu7SorJ0FaT4Onjc1pU
MD5:	07CDA8332B62726883B29290CA35FC89
SHA1:	2E3E1A7E4484225D8E25A59695E86EEA9F516EC6
SHA-256:	0D2731F16AA2C90FAEC8E63260358CBCCEDE403FAF95E3AF8C66BC2DB0729CA0
SHA-512:	A55A5A7AD3E6B084BB15D360A732F344EEB59E0ECDB8A431DC9379653D3CD828131DAF18DD91B6B45001AAEECBAA87E1AFD6EAB4A795373DCA1C4E68C7E0CC85
Malicious:	false
Preview:	hy.b............d...................!............................................. ............................... .!............................................................................................""........................................................##.......?.......................A....+...+.......+...;...@...+..I...J........?...?"..+2...4.P....? ..#(..+*.T.,..4$.V66..?0..@...I...$...$&..A.......H.......Y......"........-...........L..............LI..I...F....&.......R..N.......P).......:......F...............F.......F...M...N ..A........L..........F........!..I.......................O.......Q........Y..T..._...`...a...`...a...`....P..\....'..^....,..`...a...b...c...A...QJ..............F.......A...I....S...Q..L...F.......O...I...Q!......`...T...A...O....=...#...L...O..T...AS...T..^..._...`...a...b...\....'..^....,..`...a...b...c...A...I...........A...F....S...U..I...F...K3......I....V..O...P&...Y...]..S#..T...U(..V(..IA..T...LZ...C..F...\...OT..^....,..`...a...b...c...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-mr.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	687
Entropy (8bit):	4.239578871898771
Encrypted:	false
SSDEEP:	12:abdtltF8MN32m0c2SSYuNuA4vltG9qXLgskIU9t80dtcUe0EZA8h:aptKEGC3F4IU88yMUA8h
MD5:	0807CF29FC4C5D7D87C1689EB2E0BAAA
SHA1:	D0914FB069469D47A36D339CA70164253FCCF022
SHA-256:	F4DF224D459FD111698DD5A13613C5BBF0ED11F04278D60230D028010EAC0C42
SHA-512:	5324FD47C94F5804BFA1AA6DF952949915896A3FC77DCCAED0EEFFEAFE995CE087FAEF035AECEA6B4C864A16AD32DE00055F55260AF974F2C41AFFF14DCE00F3
Malicious:	false
Preview:	hy.b........8...............F.....H...H...H..(H..0H..8H..@H..HH..PH..XH..`H..xH...H...H...H...H...H...H...H...H...H...H...H...H...H...H...I...I...I...I.. I. (I.!0I."8I.#@I.$PI.%XI.&`I.'hI.(pI.)xI.*.I.+.I.,.I.-.I...I./.I.0.I.1.I.2.I.3.I.4.I.5.J.6.J.7.J.8.J.9 J.:8J.;@J.<XJ.=`J.>hJ.?.J.@.J.A.K.B.K.C.K.D.K.E`..Fh...............?......L............A...........A..................................................................................................................................................................................2...................................................?...@...................E...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-nb.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	145263
Entropy (8bit):	5.817435539709432
Encrypted:	false
SSDEEP:	3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
MD5:	677EDD1A17D50F0BD11783F58725D0E7
SHA1:	98FEDC5862C78F3B03DAED1FF9EFBE5E31C205EE
SHA-256:	C2771FBB1BFFF7DB5E267DC7A4505A9675C6B98CFE7A8F7AE5686D7A5A2B3DD0
SHA-512:	C368F6687FA8A2EF110FCB2B65DF13F6A67FEAC7106014BD9EA9315F16E4D7F5CBC8B4A67BA2169C6909D49642D88AE2A0A9CD3F1EB889AF326F29B379CFD3FF
Malicious:	false
Preview:	hy.b.............%..o7......A........................................................................................................................................................ !"...#......................... !"...#....?.........?...............@DB.@N.#@c..y.2.2.:@4.C.8HK.<.T@?.\.D.d@Q.m.bMv@q...q..t...}....R.....@...........@...e.........v...q.....@.^............("...c......%...C%@%...0E..7..A8G.A....9...9...#K....%A:M&A=.,.B.2.C.6.DJ.@F.:.F.A.A.H.S.P.T.T.T.Q@U.2.X.U.+...?.Z.\...^..a..c.2....@d...d...g#^..AbAg.gAj...mDmAh.r.d.wARG}.pH..s.....H.t...u.....bN......P..w...y..Ay..z..~..A~..~.Y......Y.N."....@Z...Q....P....Z.B.R.......A....A......U.........:.>.....H..5...u.(..K...L......N0@......\_........?S..4..@.U..=....@l..B.Y..a...[p..\..8...9...oIB....o..C..........+.p......@..!...;.......@1H..I.@.....K...L:..M .....5..B....(...+....S..[.:.A.....\|..A....A.Y.@.....g..........i..C..G..Bb...eF'..G........$..J1AW.IA.L.MO.#.>@..1....@...@O.6B8S=.<.C.

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-nn.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	145263
Entropy (8bit):	5.817435539709432
Encrypted:	false
SSDEEP:	3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
MD5:	F2D8FE158D5361FC1D4B794A7255835A
SHA1:	6C8744FA70651F629ED887CB76B6BC1BED304AF9
SHA-256:	5BCBB58EAF65F13F6D039244D942F37C127344E3A0A2E6C32D08236945132809
SHA-512:	946F4E41BE624458B5E842A6241D43CD40369B2E0ABC2CACF67D892B5F3D8A863A0E37E8120E11375B0BACB4651EEDB8D324271D9A0C37527D4D54DD4905AFAB
Malicious:	false
Preview:	hy.b.............%..o7......A........................................................................................................................................................ !"...#......................... !"...#....?.........?...............@DB.@N.#@c..y.2.2.:@4.C.8HK.<.T@?.\.D.d@Q.m.bMv@q...q..t...}....R.....@...........@...e.........v...q.....@.^............("...c......%...C%@%...0E..7..A8G.A....9...9...#K....%A:M&A=.,.B.2.C.6.DJ.@F.:.F.A.A.H.S.P.T.T.T.Q@U.2.X.U.+...?.Z.\...^..a..c.2....@d...d...g#^..AbAg.gAj...mDmAh.r.d.wARG}.pH..s.....H.t...u.....bN......P..w...y..Ay..z..~..A~..~.Y......Y.N."....@Z...Q....P....Z.B.R.......A....A......U.........:.>.....H..5...u.(..K...L......N0@......\_........?S..4..@.U..=....@l..B.Y..a...[p..\..8...9...oIB....o..C..........+.p......@..!...;.......@1H..I.@.....K...L:..M .....5..B....(...+....S..[.:.A.....\|..A....A.Y.@.....g..........i..C..G..Bb...eF'..G........$..J1AW.IA.L.MO.#.>@..1....@...@O.6B8S=.<.C.

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-or.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	647
Entropy (8bit):	4.1580884891492484
Encrypted:	false
SSDEEP:	12:vke/qU1skFHsUbhiZmltXz4Nw2GVlHthkIU9t80dtcUe0jum08h:82qHkqEEoUIU88yMc8h
MD5:	7E265A294303F69AA66C243F5F474463
SHA1:	4D382AB4BED3DBE481710F0C651CA87B2394661D
SHA-256:	4E9CD302BAFFC4EA3E9652327EA24072EBF37B5C4FC0719292BDAC10AAAD665B
SHA-512:	D347D422249945C9A664BE3C48E1EC07BECAF03BD3525869F06C9AA328B4FE2884AC963CB97949D97E5AB41617B0FC6F2A2171F06007BF94CCE88D55A15DA922
Malicious:	false
Preview:	hy.b........$...X...........A.....X...X...X..(X..0X..8X..@X..HX..PX..XX..`X..xX...X...X...X...X...X...X...X...X...X...X...X...X...X...X...Y...Y...Y...Y.. Y. (Y.!0Y."8Y.#@Y.$PY.%XY.&`Y.'hY.(pY.)xY.*.Y.+.Y.,.Y.-.Y...Y./.Y.0.Y.1.Y.2.Y.3.Y.4.Z.5.Z.6.Z.7.Z.88Z.9@Z.:XZ.;`Z.<hZ.=.Z.>.[.?.[.@`..Ah...............?......G............A...........A..............................................................................................................................................................................................................................=...........@...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-pa.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	607
Entropy (8bit):	4.0169087789595075
Encrypted:	false
SSDEEP:	12:MV9cE9PvVFvf1EEPHflMijlt7zvnG43fcN8Udtcct8U9t80dtcU/8Ub8h:MsENVdt/tNXX3fU80ccSU88ynu8h
MD5:	0F27E5BCCC1CD9DDF3EAC020DA27DA57
SHA1:	BD3C83300AAD3E79287C1E806E864F7644240911
SHA-256:	470329D28FAA484F945D78FFEFB176DCB6F2032C753E25BC014106AD24B2C68A
SHA-512:	141DA09A4A1A3B9E581751A1B2C70CBE981E1A915EA538A8015C7614D11BE059CD3A03B4F2420F963E5657A4417B3CC5C3A22E0028132A21363219E27751CCFB
Malicious:	false
Preview:	hy.b............0..._.......<.....P...P...P..(P..0P..8P..@P..HP..PP..xP...P...P...P...P...P...P...P...P...P...P...P...P...P...P...Q...Q...Q...Q.. Q..(Q..0Q. 8Q.!@Q."PQ.#XQ.$`Q.%hQ.&pQ.'xQ.(.Q.).Q.*.Q.+.Q.,.Q.-.Q...Q./.Q.0.Q.1.R.2.R.3.R.48R.5@R.6XR.7`R.8hR.9.S.:.S.;`..<h......?...............B.......A...B...C`...@... ..........................................................................................................................................................................................................x...y...z...;...\|...............................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-pt.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1414
Entropy (8bit):	2.57311219135147
Encrypted:	false
SSDEEP:	24:TF+k+Mo1Mo1gL82mvD2VE+hJBBSZ6s8ADrsh:RlNo1Mo1lx7+hJy8sdQh
MD5:	564FF32DED64C6BFC693F2758A53D68E
SHA1:	3965F963D36BEE1598683E72C857A3BFF196B295
SHA-256:	F6FBF1BCB260CC86256FC494F388F7B27D10865FBF8F61517DEE25AF4D58D6E8
SHA-512:	E9E574BA07703295AA8B7FD4603EF079816EA44394BD62750E08E523B9A7B408FD979552D90D04F825242CCADA7AD66003FBA76C9C8469541B5C6D2FB85C41E8
Malicious:	false
Preview:	hy.b............L...........-.................................................................................................................................................................... ..!....."#$....%............... ..!....."#$....%......?.......................A.......C.......E.......G2......B...J....:..L2.......:..........Q2.......!...*..U2......W2.......:...:...............:...............#..........................................G...........X...........B.......F....................... ...!...".......$...%...........B...............F...............J.......................P...V....................................... ...!...".......$...%................................................................................................................................................... ...!...".......$...%...........B...............F...............J.......................P........................................... ...!...".......$...%...........................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-sl.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6631
Entropy (8bit):	4.666183419763895
Encrypted:	false
SSDEEP:	96:LbHqR1cAky2TFP+HQ1QpHPZtCjUtKapFxx8mLJO/5n0PatE08YyM9eW3svUaf5lk:P21cPFPAHPGjpEr85/NVtEjoeW88af5m
MD5:	A21358DD4506643486F72F7D80D60A5B
SHA1:	FB7EE02ADC970F4D71C84D18777A59508FA1A46C
SHA-256:	AD746C68562603AC3B15E89DA03C76E081C08E7D9C8D4C9F64763E53D696C77C
SHA-512:	7DC9E18050B3DF4288AACAAFFDB17668F0B5D8B5E103305070D2EF83DAB2F5DBE3B071B05CA69340D86A53D47D4CF8197ECC1BDD086A320BF81F9DF8C0D3CCB8
Malicious:	false
Preview:	hy.b........d...............A...................................................................................................................................................................................................................................................................................................................................................................A.D...#.....d.)...E...&.g.........7..... ..l#8..&...?./....1@.Q....5...8..T;2..>...B..w...X....C...E...H...J..}K................+.....c...A.,..x/.....iw1.H :......y-..P!.....0...n.$...<...0..yC.....V...t....\| ...%.:.'.;...<.*.=.....4.".....5..0..e...F.....9.....I6...L........".....n7(.....0....}=..N..........U!....>.g.3.3}.......O..........]`...F..%{..c...d...E....z..................k...L'......n...o)..........RL..s...t.......v....z..............{...\|.......b...c........$......g...h....1..j...k...lJ..M....R...M..p...\|}...4..s...................}...t.......{...\|........(.......R..%....:...................+..

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-ta.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	554
Entropy (8bit):	4.097315344818262
Encrypted:	false
SSDEEP:	12:qOkVbj778oso/8kbX7MTADiZM3kTxPUKtcUUymPr:qdVv77yo/8AX7MTHLGKynyOr
MD5:	AB2F6F9696FC7D699356244725E7C778
SHA1:	2026841DA77DD77715B521EC73BF819D1D098B60
SHA-256:	40FDA94856A86F065DE8BAA6184EA63DCDB011EE4CA498A7C1FEE44C99314C67
SHA-512:	88A4C2117102BDB60D482448C36DD79A8DA1130A4636513C8ED56EB282DA6C638D27EABC9799EAB8BC1A7234A0AA6690C55408500608387912FE283F13BCC328
Malicious:	false
Preview:	hy.b.......................3.....\...\..(\..0\..8\..@\..H\..P\..p\..x\...\...\...\...\...\...\...\...\...\...\...].. ]..@]..H]..P]..p]..x]...]...]...]...]. .].!.].".].#.].$.].%.].&.].'.^.(.^.).^.0^.+8^.,@^.-P^..X^./`^.0h^.1.^.2`..3h......?...............<........@...0...a.......A...!.......Q..........................O...P...Q...R...S...T...U...V...W.......Y...Z...[...\...]...^..._...`...a...b...c...d...............................................................0...0...................................,.............................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-te.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	703
Entropy (8bit):	4.223695084085508
Encrypted:	false
SSDEEP:	12:A1l1ltFUcfE8Uceyqw2ttN6rOODQlESkP9t80dtcU9tFj0osZE8h:A1icE8UcZPH88yUFIbZE8h
MD5:	BF9DF63B3C97DE3BFF99E24EE4BC5F2E
SHA1:	774659CF1D58BCFC69900315281E99E038CD2A97
SHA-256:	516FA9654FA3AEAAB480D40EAF6AD78FC039086BD8EDC144BE3D59525EDCAC29
SHA-512:	52F40A2C38CC62AA6B0E081C90B9DFCD6D3ED03A4A90E596E11AC85BFDA96EAA74D465CD7168B803C0D59A53DF878B0EA1CA657C5CAF3DE49C8758CBD527BEE2
Malicious:	false
Preview:	hy.b........@...............H.....`...`...`..(`..0`..8`..@`..H`..P`..X`..``..p`..x`...`...`...`...`...`...`...`...`...`...`...`...`...`...`...`...a...a...a. .a.! a."(a.#0a.$8a.%@a.&Pa.'Xa.(`a.)ha.*pa.+xa.,.a.-.a...a./.a.0.a.1.a.2.a.3.a.4.a.5.a.6.a.7.b.8.b.9.b.:.b.; b.<0b.=8b.>@b.?Pb.@Xb.A`b.Bhb.C.b.D.b.E.c.F.c.G`..Hh...............?......N............A...........A......................................................................................................................................................................................................................................................C...D...........G...................................(......................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-tk.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2712
Entropy (8bit):	2.634842338757876
Encrypted:	false
SSDEEP:	48:pOWZMS0jrjvFgj3PgjY8jKHjgj5D+SlRAd5+UjbxgjUKdHyM:l0fzODok8+jg9D+eRA6UnxgTdHyM
MD5:	ED60185B6F455B6F8ED27EAEB73334A9
SHA1:	11E53BDA5E2A0ACD000692AD8AF45611B57277AD
SHA-256:	77FDAED29BD842AAA976AB7EF81B617A15C0A2D1EBD1161C1BF26B79A108B5CD
SHA-512:	3EF211A330EFE9E34468C9C460DFCDA1B8DA80D113317A177205C76FFCB916FF25FFCB4485703FD01EE248D356A67E5BB18DF8E5EA40B2AAB3999121083B7E30
Malicious:	false
Preview:	hy.b........x...d...........-...............................................................................................................................................................................................................................................................................................................................................................................5.......!...b....2...2..E$.....G....2..I$...2..K........2......o....2..1........2..t........ ...2..X$...2...'...+..</...2......2..c...d6......f6..g6..h6......j6..k6..l6..m6..n6.....p6..q6..r6..s6......u6......w6......y6..........\|6..}6..~6...6..C...D.......F...G...H.......J...K...L...M...N.......P...Q...R....B......U.......W.......Y...........\...]...^..._...C...D.......F...G...H.......J....B..L....B..N........B..Q........B......U.......W.......Y...........\...]...^..._...C...D.......F.......H.......J...K...L...M...N.......P...Q....B...B......U.......W.......Y...........\...]...^..._...C...D...

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\hyph-und-ethi.hyb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3484
Entropy (8bit):	5.253138005413701
Encrypted:	false
SSDEEP:	48:KEn0vz7f+IXVNBMWXma7WWDrOEKYa3FZxU6b7JXkB5/Xh5f3B5PBhPPhhvPK0OEl:Fy5VNB9XrbDHKYKZHpEx5fxhPf7O0V
MD5:	4AA9B2C0C9CCDE5140D01DC6502242BB
SHA1:	D1759E8A62A42A72529ADF9BC73820BF32F2A37B
SHA-256:	1DE83CB787DFAF53FB7E6E8DB3AAE5008AD24EBDD28BE02031306EA9E9F3E285
SHA-512:	1B456301D814810E857E8A0C426E703A802FEBB5C3DFD8D0E5C58AEEFC6C2D6F55C95830024C243D2BFBB8322EF72E9FF959CDC7F92AE51BEBE8B053D9CDA1E5
Malicious:	false
Preview:	hy.b............\|................................ ...(...0...8...@...H...P...X...`...h...p...x......................................................... ...!..."...#...$...% ..&(..'0..(8..)@..*H..+P..,X..-`...h../p..0x..1...2...3...4...5...6...7...8...9...:..;..<..=...>..?..@...A...B...C...D...E ..F(..G0..H8..I@..JP..KX..L`..Mh..N...O...P...Q...R...S...T...U...V..W..X...Y..Z...[...\...]...^ .._(..`0..a8..b@..cH..dP..eX..f`..gh..hp..ix..j...k...l...m...n...o...p...q...r...s..t..u..v...w..x..y...z...{...\|...}...~ ...(...0...8...@...P...X...`...h.............................................................................. ...(...0...8...@...H...P...X...`...h...p...x.......................................................... ...(...@...H...P...X...`...h...p...x..................................................................... ...(...0...8...@...H...P...X...`...h...p...x................................................................

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\manifest.fingerprint

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	66
Entropy (8bit):	3.9835870213532285
Encrypted:	false
SSDEEP:	3:SRaKulTCPb7dkaV5SmrgQ:SAlTibV5Vp
MD5:	B1AC407DA8BE9C08FB89FE7D240E67FB
SHA1:	5C46AD3757942D5DF814F861DF942143572AAA47
SHA-256:	0866E6D6D26EF20BC94270C9A0265D9A2FAB9AEF097449D35CA868124A2AB3A9
SHA-512:	0A35C8F55272B00FE1FC38022C56681C27C4172E739D5320F4395C6804A4541676F7F4DDF98F381DE721F719BDD8248815694677F4C21C33F6CF01F9F65CA9B4
Malicious:	false
Preview:	1.42AF0D1905C8F1D8F6167365271C4549A73603B838BA58B9A664C57C00DB1EE5

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_1008386583\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.612592734422109
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFbykJvFgS1DlaRLEeSWU4pv/8F/FxLj2RF2fcTZTotL:F6VlMhyk0S14QWfB0NpK4aotL
MD5:	273755BB7D5CC315C91F47CAB6D88DB9
SHA1:	C933C95CC07B91294C65016D76B5FA0FA25B323B
SHA-256:	0E22719A850C49B3FBA3F23F69C8FF785CE3DEE233030ED1AD6E6563C75A9902
SHA-512:	0E375846A5B10CC29B7846B20A5A9193EA55FF802F668336519FF275FB3D179D8D6654FE1D410764992B85A309A3E001CEDE2F4ACDEC697957EB71BDEB234BD8
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "hyphens-data",. "version": "101.0.4906.0",. "imageName": "image.squash",. "squash": true,. "fsType": "squashfs",. "isRemovable": false.}

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_911341631\manifest.fingerprint

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.87107305218322
Encrypted:	false
SSDEEP:	3:SddQLtQSnUunhU1mWrO2V:S/QZHThyay
MD5:	0C9218609241DBAA26EBA66D5AAF08AB
SHA1:	31F1437C07241E5F075268212C11A566CEB514EC
SHA-256:	52493422AC4C18918DC91EF5C4D0E50C130EA3AA99915FA542B890A79EA94F2B
SHA-512:	5D25A1FB8D9E902647673975F13D7CA11E1F00F3C19449973D6B466D333198768E777B8CAE5BECEF5C66C9A0C0EF320A65116B5070C66E3B9844461BB0FFA47F
Malicious:	false
Preview:	1.8BFD50D350D47445B57BB1D61BBDE41CEDA7AC43DC81FCE95BF1AC646D97D2A0

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_911341631\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	134
Entropy (8bit):	4.405914533496662
Encrypted:	false
SSDEEP:	3:3FFhAWAUNhRKpEbXKS2XAXMWxQHJCzhiFfASvAcWxQHJCr2SkhSA:3FFWeRl2QIpCU4SvrpCSSkhSA
MD5:	58D3CA1189DF439D0538A75912496BCF
SHA1:	99AF5B6A006A6929CC08744D1B54E3623FEC2F36
SHA-256:	A946DB31A6A985BDB64EA9F403294B479571CA3C22215742BDC26EA1CF123437
SHA-512:	AFD7F140E89472D4827156EC1C48DA488B0D06DAAA737351C7BEC6BC12EDFC4443460C4AC169287350934CA66FB2F883347ED8084C62CAF9F883A736243194A2
Malicious:	false
Preview:	{.. "description" : "AutoLaunch Protocols Preregistration",.. "name" : "Protocol Preregistration",.. "version" : "1.0.0.8"..}

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping9048_911341631\protocols.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3164
Entropy (8bit):	4.532278538438865
Encrypted:	false
SSDEEP:	48:O//uidcRcrcNc0cTc8cs+PcrcNc0cTc8csLcrcNc0cTc8cstcrcNc0cTc8csH:O//uWJ2UH
MD5:	6BBB18BB210B0AF189F5D76A65F7AD80
SHA1:	87B804075E78AF64293611A637504273FADFE718
SHA-256:	01594D510A1BBC016897EC89402553ECA423DFDC8B82BAFBC5653BF0C976F57C
SHA-512:	4788EDCFA3911C3BB2BE8FC447166C330E8AC389F74E8C44E13238EAD2FA45C8538AEE325BD0D1CC40D91AD47DEA1AA94A92148A62983144FDECFF2130EE120D
Malicious:	false
Preview:	{.. "allow": [.. {.. "origins": [.. "https://.get.microsoft.com",.. "https://.apps.microsoft.com".. ],.. "protocol": "ms-windows-store".. },.. {.. "origins": [.. "https://.onedrive.com",.. "https://.onedrive.live.com",.. "https://sharepoint.com".. ],.. "protocol": "ms-word".. },.. {.. "origins": [.. "https://[a-z1-9-]word-edit.officeapps.live.com",.. "https://[a-z1-9-]word-view.officeapps.live.com",.. "https://[a-z1-9-]onenote.officeapps.live.com",.. "https://[a-z1-9-]eap.officeapps.live.com",.. "https://[a-z1-9-]shared.officeapps.live.com",.. "https://[a-z1-9-]afhs.officeapps.live.com",.. "https://[a-z1-9-]vhs.officeapps.live.com",.. "https://[a-z1-9-]optin.online.office.com".. ],.. "use_regex": true,.. "protocol": "ms-word".. },.. {.. "origins": [.. "https://.onedrive.com",.. "https://.onedrive.li

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.3483070380771895
Encrypted:	false
SSDEEP:	12:Y1PHjFkpJ0Dkv/kgN56s/PR0f0Dkv/PQ56s/C:Y1PHJkpJ0N85xRM0qQ5M
MD5:	F335F3C6ADD88F5F4CD1C2F5AD4B1F4D
SHA1:	ED66C006BD1792018765982963A68ECF67D615CC
SHA-256:	D927E66533D852DB902A7A1416C5CBB996B2E991C498D5CF599F5F333F3039DC
SHA-512:	E7D9C1F55B08B849FD922F7F0C43830F811027DC19C7E62F6AEF967EFBE6DCC6731C0428897BBD9D540DA703427A5A4FB3BF7383FB25A3C2411F2FB5BC8A7A36
Malicious:	false
Preview:	{"logTime": "0904/013500", "correlationVector":"3467B6A6A62144FF8007FB9F991FEB4A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0904/013512", "correlationVector":"49g0Hg4t/yzdeRICBMYEtI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0904/013513", "correlationVector":"0B16152851004F19B581E721B9F6C8B2","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0904/013513", "correlationVector":"5Oc92+fjJdbQg+QOuqbgXe","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\e51091fe-443a-4ae8-95aa-6cbb24707a81.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\8035834f-a7a1-4848-a136-a165f1d8fe59.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir9048_101411725\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir9048_517828207\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir9048_517828207\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9048_517828207\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9048_517828207\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9048_517828207\c4c64b0c-9dae-4a82-af82-2ce84e5324b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.521053374664896
Encrypted:	false
SSDEEP:	48:hEtT2dO1uQsJZrhzBdLXuHykDp/2AlhdO1SQsJZrhzngdLXuHyk+21:aO3uSkDoynIuSkz
MD5:	1478FF80B9063BB139D5ABBECDCAAD82
SHA1:	0B092126E1591CDF8723448DB4DD3DCA28BF3A9D
SHA-256:	FC27B0F3640B03CF3360EBEBBE6FF71710D17A9D5F73E7FC0457FE7DCD4AFCAE
SHA-512:	EBC2A6184C1207D1213EE185A81E303D8284C37E618936083A8E61C730F419A9159462920E30EC4E77CBA78C6BE5E48EBEE0B98D8EE83418F30ECAA368ABC491
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....$.j....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V.......J.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.$Y\...............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.$Y\...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.$Y\.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j.............j......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HMWNY4M1VOM7QE5O7QQD.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5159230308084477
Encrypted:	false
SSDEEP:	48:IElhdO1SQsJZrhzBdLXuHykDpK2AlhdO1SQsJZrhzngdLXuHyk+21:v3uSkDZynIuSkz
MD5:	ED8CC5DB79D602D452C96B5680AAA1CB
SHA1:	02A0F3FED9CC2243C922E2D455236F552F7827F5
SHA-256:	C69DF805814012CBA7C76BDEA78B7E14204F4B6AE5E82059598A8CFA981BF304
SHA-512:	2FDA76CE2147E895E0D6FF48C362A999EFC775BE510134FF50C2AF6A93215281430ACCFA765AC433B1DD36D8906643EF5E6AD07573AC953387EF958830330DE3
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....@;.j....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....$YZ...PROGRA~2.........O.I$YZ.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.$Y\...............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.$Ya............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.$Y\...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.$Y\.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j.............j......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NJ20IGH8U86VGA5XTLDL.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.521053374664896
Encrypted:	false
SSDEEP:	48:hEtT2dO1uQsJZrhzBdLXuHykDp/2AlhdO1SQsJZrhzngdLXuHyk+21:aO3uSkDoynIuSkz
MD5:	1478FF80B9063BB139D5ABBECDCAAD82
SHA1:	0B092126E1591CDF8723448DB4DD3DCA28BF3A9D
SHA-256:	FC27B0F3640B03CF3360EBEBBE6FF71710D17A9D5F73E7FC0457FE7DCD4AFCAE
SHA-512:	EBC2A6184C1207D1213EE185A81E303D8284C37E618936083A8E61C730F419A9159462920E30EC4E77CBA78C6BE5E48EBEE0B98D8EE83418F30ECAA368ABC491
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K.....$.j....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWQ`..PROGRA~2.........O.IDWQ`....................V.......J.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.$Y\...............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.$Y\...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.$Y\.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j.............j......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5159230308084477
Encrypted:	false
SSDEEP:	48:IElhdO1SQsJZrhzBdLXuHykDpK2AlhdO1SQsJZrhzngdLXuHyk+21:v3uSkDZynIuSkz
MD5:	ED8CC5DB79D602D452C96B5680AAA1CB
SHA1:	02A0F3FED9CC2243C922E2D455236F552F7827F5
SHA-256:	C69DF805814012CBA7C76BDEA78B7E14204F4B6AE5E82059598A8CFA981BF304
SHA-512:	2FDA76CE2147E895E0D6FF48C362A999EFC775BE510134FF50C2AF6A93215281430ACCFA765AC433B1DD36D8906643EF5E6AD07573AC953387EF958830330DE3
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K....@;.j....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....$YZ...PROGRA~2.........O.I$YZ.....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.$Y\...............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.$Ya............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.$Y\...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.$Y\.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j.............j......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579772669836572
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	7a10fee1036074d25e1e08d620db8fb3
SHA1:	5d3e26f4b861fd5cab7b7800830ee82ed5c4242e
SHA256:	415b8003e03b51922260c6a3debf0a4b35e878bf04596733fa915fbde2c7694c
SHA512:	a6bd89eed43d87d0fcd1975c8782392a32a40644c5539a7481be5cf10b9e1997ed310ea6dad87b438d97410520780f4b4af0a92bc546481a0b81484ec4a458f2
SSDEEP:	12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTU:SqDEvCTbMWu7rQYlBQcBiT6rprG8asU
TLSH:	F4159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D7AA05 [Wed Sep 4 00:29:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F885CED8813h
jmp 00007F885CED811Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F885CED82FDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F885CED82CAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F885CEDAEBDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F885CEDAF08h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F885CEDAEF1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	de64b77a01b94a44c5dd33858bac34a3	False	0.286953125	data	5.164549511635082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 4, 2024 03:34:59.989057064 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 4, 2024 03:35:02.045639992 CEST	49748	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.045671940 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.045763016 CEST	49748	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.045977116 CEST	49748	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.045989037 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.133915901 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.133950949 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.134020090 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.134285927 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.134294987 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.720411062 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.739937067 CEST	49748	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.739959955 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.741043091 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.741122961 CEST	49748	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.743891954 CEST	49748	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.743952990 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.763392925 CEST	49748	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.763407946 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.787067890 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.789403915 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.789426088 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.790482998 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.790561914 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.796386957 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.796447039 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.796544075 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.796550989 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.813303947 CEST	49748	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.864670038 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.864695072 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.864722013 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.864753008 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.864763021 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.864775896 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.864784002 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.864789963 CEST	49748	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.864837885 CEST	49748	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.899765015 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.899786949 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.899857998 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.899880886 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.899893999 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.899935961 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.988090038 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.988101006 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.988140106 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.988151073 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.988184929 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.988203049 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.988239050 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.988255024 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.990608931 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.990643024 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.990731001 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:02.990742922 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:02.990896940 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:03.000349045 CEST	49748	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:03.000375986 CEST	443	49748	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:03.075176954 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:03.075206995 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:03.075246096 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:03.075264931 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:03.075289965 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:03.075313091 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:03.075881958 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:03.075928926 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:03.075939894 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:03.075953960 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:03.075990915 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:03.081711054 CEST	49749	443	192.168.2.4	13.107.246.42
Sep 4, 2024 03:35:03.081728935 CEST	443	49749	13.107.246.42	192.168.2.4
Sep 4, 2024 03:35:03.134516001 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.134553909 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.134634018 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.135025024 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.135057926 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.135111094 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.135272980 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.135288954 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.135446072 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.135459900 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.135653973 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.135663986 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.135771036 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.136110067 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.136120081 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.136404037 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.136411905 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.136640072 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.136842966 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.136852026 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.263698101 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.263727903 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.263783932 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.264303923 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.264318943 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.593352079 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.593553066 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.593565941 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.594597101 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.594650030 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.595583916 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.595647097 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.595732927 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.595738888 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.597246885 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.597429037 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.597445011 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.598504066 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.598562002 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.599447966 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.599536896 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.599576950 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.613744974 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.613934994 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.613941908 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.614779949 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.614834070 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.615660906 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.615717888 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.615871906 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.615880013 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.619339943 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.619551897 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.619568110 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.620399952 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.620450974 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.621329069 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.621385098 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.621542931 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.621548891 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.641235113 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.641242027 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.672455072 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.692394018 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.692394018 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.692545891 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.705781937 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.705843925 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.705928087 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.706007004 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.706017017 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.716886044 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.717084885 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.717092991 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.717943907 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.718013048 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.718847990 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.718900919 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.719082117 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.719086885 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.726969957 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.727025032 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.727066040 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.727704048 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.727715015 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.742347956 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.742420912 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.742476940 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.744448900 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.744462967 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.745183945 CEST	49761	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:03.745229006 CEST	443	49761	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:03.745332956 CEST	49761	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:03.747275114 CEST	49761	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:03.747289896 CEST	443	49761	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:03.754929066 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.754976034 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.755043983 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.755142927 CEST	49755	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:03.755153894 CEST	443	49755	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:03.771189928 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.845546007 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.845591068 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:03.845638990 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.845777035 CEST	49756	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:03.845786095 CEST	443	49756	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:04.394407034 CEST	443	49761	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:04.394484043 CEST	49761	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:04.400542974 CEST	49761	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:04.400557041 CEST	443	49761	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:04.400767088 CEST	443	49761	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:04.514694929 CEST	49761	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:04.556504011 CEST	443	49761	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:04.701178074 CEST	443	49761	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:04.701221943 CEST	443	49761	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:04.701288939 CEST	49761	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:04.701405048 CEST	49761	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:04.701422930 CEST	443	49761	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:04.701433897 CEST	49761	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:04.701442003 CEST	443	49761	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:04.727977991 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:04.728004932 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:04.728257895 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:04.728580952 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:04.728593111 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:05.129522085 CEST	49763	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.129554987 CEST	443	49763	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.129668951 CEST	49763	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.130089998 CEST	49764	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.130115986 CEST	443	49764	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.130162954 CEST	49764	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.130352020 CEST	49763	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.130364895 CEST	443	49763	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.130599022 CEST	49764	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.130611897 CEST	443	49764	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.372282028 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:05.372366905 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:05.409918070 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:05.409939051 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:05.410147905 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:05.420967102 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:05.468508005 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:05.582829952 CEST	443	49763	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.583197117 CEST	49763	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.583214045 CEST	443	49763	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.583487034 CEST	443	49763	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.583846092 CEST	49763	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.583897114 CEST	443	49763	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.601865053 CEST	443	49764	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.603859901 CEST	49764	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.603877068 CEST	443	49764	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.604223967 CEST	443	49764	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.610344887 CEST	49764	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.610414028 CEST	443	49764	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.633114100 CEST	49763	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.650152922 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:05.650175095 CEST	443	49765	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:05.650194883 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:05.650238991 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:05.650276899 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:05.650306940 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:05.650341034 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:05.650347948 CEST	443	49766	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:05.650732040 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:05.650742054 CEST	443	49765	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:05.650762081 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:05.650939941 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:05.650952101 CEST	443	49766	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:05.668610096 CEST	49764	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.676743031 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:05.676764965 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:05.676776886 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 03:35:05.676784992 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 03:35:05.950964928 CEST	49767	443	192.168.2.4	142.250.80.68
Sep 4, 2024 03:35:05.950998068 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:05.951057911 CEST	49767	443	192.168.2.4	142.250.80.68
Sep 4, 2024 03:35:05.951272964 CEST	49767	443	192.168.2.4	142.250.80.68
Sep 4, 2024 03:35:05.951284885 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.214730024 CEST	443	49766	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.214931011 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.214946985 CEST	443	49766	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.215272903 CEST	443	49766	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.215323925 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.215900898 CEST	443	49766	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.215948105 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.217286110 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.217338085 CEST	443	49766	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.217484951 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.217493057 CEST	443	49766	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.220139027 CEST	443	49765	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.220319033 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.220329046 CEST	443	49765	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.221151114 CEST	443	49765	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.221191883 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.222590923 CEST	443	49765	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.222629070 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.223445892 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.223577023 CEST	443	49765	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.223699093 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.223706007 CEST	443	49765	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.292300940 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.292300940 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.324050903 CEST	443	49766	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.324251890 CEST	443	49766	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.324295998 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.324836969 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.324851990 CEST	443	49766	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.324863911 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.324898005 CEST	49766	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.330358028 CEST	443	49765	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.330420971 CEST	443	49765	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.330459118 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.330846071 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.330853939 CEST	443	49765	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.330864906 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.330893993 CEST	49765	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.420607090 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.420866966 CEST	49767	443	192.168.2.4	142.250.80.68
Sep 4, 2024 03:35:06.420881987 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.421729088 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.421777010 CEST	49767	443	192.168.2.4	142.250.80.68
Sep 4, 2024 03:35:06.423234940 CEST	49767	443	192.168.2.4	142.250.80.68
Sep 4, 2024 03:35:06.423284054 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.423460960 CEST	49767	443	192.168.2.4	142.250.80.68
Sep 4, 2024 03:35:06.423468113 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.466439962 CEST	49767	443	192.168.2.4	142.250.80.68
Sep 4, 2024 03:35:06.519191027 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.519237041 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.519263029 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.519277096 CEST	49767	443	192.168.2.4	142.250.80.68
Sep 4, 2024 03:35:06.519294024 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.519331932 CEST	49767	443	192.168.2.4	142.250.80.68
Sep 4, 2024 03:35:06.519340038 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.519385099 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.519434929 CEST	49767	443	192.168.2.4	142.250.80.68
Sep 4, 2024 03:35:06.520605087 CEST	49767	443	192.168.2.4	142.250.80.68
Sep 4, 2024 03:35:06.520621061 CEST	443	49767	142.250.80.68	192.168.2.4
Sep 4, 2024 03:35:06.642005920 CEST	49768	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.642034054 CEST	443	49768	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.642081976 CEST	49768	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.642524958 CEST	49769	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.642550945 CEST	443	49769	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.642605066 CEST	49769	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.642729044 CEST	49768	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.642741919 CEST	443	49768	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.642885923 CEST	49769	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.642899990 CEST	443	49769	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.350008965 CEST	443	49769	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.350286007 CEST	49769	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.350310087 CEST	443	49769	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.350717068 CEST	443	49769	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.350778103 CEST	443	49768	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.350810051 CEST	49769	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.351216078 CEST	49768	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.351233006 CEST	443	49768	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.351490021 CEST	443	49769	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.351563931 CEST	443	49768	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.351594925 CEST	49769	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.351706982 CEST	49769	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.351710081 CEST	49768	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.351768970 CEST	443	49769	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.352164030 CEST	443	49768	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.352317095 CEST	49768	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.352317095 CEST	49768	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.352368116 CEST	443	49768	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.392364025 CEST	49769	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.392364025 CEST	49768	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.392379045 CEST	443	49768	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.392380953 CEST	443	49769	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.439271927 CEST	49768	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.439409018 CEST	49769	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:13.518733978 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:13.518769979 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:13.518904924 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:13.519973040 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:13.519988060 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:13.589904070 CEST	49672	443	192.168.2.4	173.222.162.32
Sep 4, 2024 03:35:13.589932919 CEST	443	49672	173.222.162.32	192.168.2.4
Sep 4, 2024 03:35:13.873545885 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:13.873568058 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:13.873716116 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:13.873919010 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:13.873931885 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.304900885 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:14.304971933 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:14.309920073 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:14.309930086 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:14.310169935 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:14.429254055 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:14.493796110 CEST	49779	443	192.168.2.4	13.107.246.57
Sep 4, 2024 03:35:14.493810892 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:14.493880033 CEST	49779	443	192.168.2.4	13.107.246.57
Sep 4, 2024 03:35:14.494070053 CEST	49779	443	192.168.2.4	13.107.246.57
Sep 4, 2024 03:35:14.494077921 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:14.526411057 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.526994944 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.527012110 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.527323008 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.527337074 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.527376890 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.527388096 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.527466059 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.527929068 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.530028105 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.530093908 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.530280113 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.530288935 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.632358074 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.796055079 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.796097994 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.796154022 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.796169043 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.798979044 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.799966097 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.799977064 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.805334091 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.806020975 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.806031942 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.811567068 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.811618090 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.811628103 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.817940950 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.818000078 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.818011045 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.824296951 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.826024055 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.826035976 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.830485106 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.834017038 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.834028006 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.836854935 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.836916924 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.836927891 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.886486053 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.886641026 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.886670113 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.886697054 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.886709929 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.886733055 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.892066956 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.894013882 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.894025087 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.898277044 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.902017117 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.902028084 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.904665947 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.904720068 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.904731035 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.911057949 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.912260056 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.912270069 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.917213917 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.918015957 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.918025970 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.923597097 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.926016092 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.926027060 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.929847002 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.929900885 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.929910898 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.935645103 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.938014984 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.938024998 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.941085100 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.941137075 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.941147089 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.946544886 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.946588993 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.946599960 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.952023029 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.952131033 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.952142954 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.957458019 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.957638025 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.957649946 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.963120937 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.965388060 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.965399027 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.968389988 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.969611883 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.969620943 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.976994038 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.977756023 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.977821112 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.977832079 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.978002071 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.978007078 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.981786966 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.981990099 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.982001066 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.985445023 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.985491037 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.985502005 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.989025116 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.989142895 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.989155054 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.990518093 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:14.992543936 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.992620945 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.992633104 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.995973110 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.996069908 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.996082067 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.999439955 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:14.999491930 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:14.999502897 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.002983093 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.003047943 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.003058910 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.006452084 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.006501913 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.006514072 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.010232925 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.010282993 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.010293007 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.013490915 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.013547897 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.013557911 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.017002106 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.017149925 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.017160892 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.020484924 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.020539045 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.020550013 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.023968935 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.024029016 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.024039984 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.027586937 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.027638912 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.027648926 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.031032085 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.031085968 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.031095982 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.034485102 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.034677029 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.034687996 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.036504984 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.038029909 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.038121939 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.038131952 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.043071985 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.043117046 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.043132067 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.044838905 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.044909954 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.044920921 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.048204899 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.048252106 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.048263073 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.059783936 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.059813976 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.059844017 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.059849024 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.059859991 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.059887886 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.060096979 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.060126066 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.060138941 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.060144901 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.060182095 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.060501099 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.060595989 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.060643911 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.060832024 CEST	49777	443	192.168.2.4	142.250.185.65
Sep 4, 2024 03:35:15.060842991 CEST	443	49777	142.250.185.65	192.168.2.4
Sep 4, 2024 03:35:15.131360054 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:15.131604910 CEST	49779	443	192.168.2.4	13.107.246.57
Sep 4, 2024 03:35:15.131614923 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:15.132462978 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:15.132523060 CEST	49779	443	192.168.2.4	13.107.246.57
Sep 4, 2024 03:35:15.133657932 CEST	49779	443	192.168.2.4	13.107.246.57
Sep 4, 2024 03:35:15.133806944 CEST	49779	443	192.168.2.4	13.107.246.57
Sep 4, 2024 03:35:15.133810997 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:15.133841038 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:15.234033108 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:15.234076023 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:15.234107971 CEST	49779	443	192.168.2.4	13.107.246.57
Sep 4, 2024 03:35:15.234118938 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:15.234150887 CEST	49779	443	192.168.2.4	13.107.246.57
Sep 4, 2024 03:35:15.234164953 CEST	49779	443	192.168.2.4	13.107.246.57
Sep 4, 2024 03:35:15.234226942 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:15.234340906 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:15.234391928 CEST	49779	443	192.168.2.4	13.107.246.57
Sep 4, 2024 03:35:15.236488104 CEST	49779	443	192.168.2.4	13.107.246.57
Sep 4, 2024 03:35:15.236498117 CEST	443	49779	13.107.246.57	192.168.2.4
Sep 4, 2024 03:35:15.249842882 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.249861956 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.249869108 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.249902010 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.249918938 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.249918938 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:15.249929905 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.249942064 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.249957085 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:15.249963999 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.249970913 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.249978065 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:15.249979973 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.249998093 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:15.250009060 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.250020981 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:15.250092983 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:15.250720978 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.250787020 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.250853062 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:15.854415894 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:15.854454041 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:15.854480982 CEST	49774	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:15.854487896 CEST	443	49774	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:17.524655104 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:17.524679899 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:17.525238037 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:17.525423050 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:17.525434971 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:17.527005911 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:17.527013063 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:17.527087927 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:17.527309895 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:17.527318954 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:17.663158894 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:17.663184881 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:17.665225983 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:17.665750980 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:17.665760994 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:17.988352060 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:17.988523006 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:17.988688946 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:17.988718033 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:17.988820076 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:17.988831043 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:17.990111113 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:17.990166903 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:17.990180969 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:17.990304947 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:17.991430044 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:17.991493940 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:17.992007971 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:17.992070913 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:17.992109060 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:17.992117882 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:17.992357016 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:17.992362976 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:18.032987118 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:18.032987118 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:18.113410950 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:18.113466024 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:18.113516092 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:18.113739967 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:18.113764048 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:18.118103981 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:18.118350983 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:18.118369102 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:18.119235992 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:18.119293928 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:18.120342016 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:18.120389938 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:18.120501995 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:18.126673937 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:18.126733065 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:18.126792908 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:18.126929045 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:18.126938105 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:18.164501905 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:18.221999884 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:18.222007990 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:18.255192041 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:18.255261898 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:18.255579948 CEST	49788	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:18.255589008 CEST	443	49788	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:21.492789984 CEST	443	49763	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:21.492854118 CEST	443	49763	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:21.492856979 CEST	443	49764	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:21.492912054 CEST	49763	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:21.492969990 CEST	443	49764	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:21.493009090 CEST	49764	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.001562119 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.001590967 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.001672029 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.002089977 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.002095938 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.002192974 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.002576113 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.002587080 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.002731085 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.002739906 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.456065893 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.456367016 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.456389904 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.456710100 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.458091021 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.458338022 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.458400011 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.458739042 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.458746910 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.459081888 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.459811926 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.460052967 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.460122108 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.504501104 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.514194012 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.582515955 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.582580090 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.582737923 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.582930088 CEST	49789	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.582940102 CEST	443	49789	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.583452940 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 4, 2024 03:35:32.583468914 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:32.583623886 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 4, 2024 03:35:32.583982944 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 4, 2024 03:35:32.583991051 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:33.136980057 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:33.137260914 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 4, 2024 03:35:33.137269974 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:33.138133049 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:33.138196945 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 4, 2024 03:35:33.139360905 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 4, 2024 03:35:33.139410019 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:33.139703035 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 4, 2024 03:35:33.139708996 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:33.186093092 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 4, 2024 03:35:33.238487959 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:33.239715099 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:33.239722967 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:33.239747047 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:33.239763021 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:33.239778996 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 4, 2024 03:35:33.240006924 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 4, 2024 03:35:33.240375996 CEST	49791	443	192.168.2.4	152.195.19.97
Sep 4, 2024 03:35:33.240381002 CEST	443	49791	152.195.19.97	192.168.2.4
Sep 4, 2024 03:35:33.698262930 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:33.698308945 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:33.698379040 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:33.698592901 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:33.698628902 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:33.698679924 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:33.698772907 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:33.698790073 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:33.698918104 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:33.698939085 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.156985998 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.158188105 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.158214092 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.158495903 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.158807993 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.158865929 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.159082890 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.190666914 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.190926075 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.190953016 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.191308975 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.191786051 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.191850901 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.200510025 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.235285044 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.296900988 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.296957016 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.297034979 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.297802925 CEST	49793	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.297821999 CEST	443	49793	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:47.368333101 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:47.368406057 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:47.368459940 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:49.096003056 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:49.096062899 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:49.096113920 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:52.306884050 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:52.306912899 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:52.306998968 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:52.307348967 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:52.307358980 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:52.406398058 CEST	49769	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:52.406410933 CEST	49768	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:52.406414986 CEST	443	49769	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:52.406421900 CEST	443	49768	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:53.084167957 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.084247112 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:53.087613106 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:53.087622881 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.087846994 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.096961021 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:53.144494057 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.591449976 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.591480970 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.591500044 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.591547966 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:53.591579914 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.591597080 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:53.591620922 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:53.591825962 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.591864109 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.591881037 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:53.591886997 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.591907978 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:53.591918945 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.591957092 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:53.597282887 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:53.597301006 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:53.597311020 CEST	49796	443	192.168.2.4	20.114.59.183
Sep 4, 2024 03:35:53.597316980 CEST	443	49796	20.114.59.183	192.168.2.4
Sep 4, 2024 03:35:57.131823063 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.131859064 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.131917953 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.132101059 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.132107973 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.132153988 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.132334948 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.132349014 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.132550001 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.132560968 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.812176943 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.812587023 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.812598944 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.812953949 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.813237906 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.813245058 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.813343048 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.813446999 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.813453913 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.813740015 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.813987970 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.814043999 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.860296965 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.860297918 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:59.908740044 CEST	49800	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:59.908767939 CEST	443	49800	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:59.908838034 CEST	49800	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:59.908912897 CEST	49801	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:59.908941031 CEST	443	49801	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:59.908991098 CEST	49801	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:59.909138918 CEST	49800	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:59.909153938 CEST	443	49800	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:59.909259081 CEST	49801	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:59.909275055 CEST	443	49801	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.368356943 CEST	443	49801	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.369198084 CEST	49801	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.369216919 CEST	443	49801	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.369554043 CEST	443	49801	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.369820118 CEST	49801	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.369889021 CEST	443	49801	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.377495050 CEST	443	49800	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.377723932 CEST	49800	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.377736092 CEST	443	49800	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.378012896 CEST	443	49800	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.378345013 CEST	49800	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.378401995 CEST	443	49800	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.422243118 CEST	49801	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.422245026 CEST	49800	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.475368023 CEST	49802	443	192.168.2.4	23.200.0.42
Sep 4, 2024 03:36:00.475409031 CEST	443	49802	23.200.0.42	192.168.2.4
Sep 4, 2024 03:36:00.475496054 CEST	49802	443	192.168.2.4	23.200.0.42
Sep 4, 2024 03:36:00.475658894 CEST	49802	443	192.168.2.4	23.200.0.42
Sep 4, 2024 03:36:00.475675106 CEST	443	49802	23.200.0.42	192.168.2.4
Sep 4, 2024 03:36:00.969799995 CEST	443	49802	23.200.0.42	192.168.2.4
Sep 4, 2024 03:36:00.970177889 CEST	49802	443	192.168.2.4	23.200.0.42
Sep 4, 2024 03:36:00.970199108 CEST	443	49802	23.200.0.42	192.168.2.4
Sep 4, 2024 03:36:00.970498085 CEST	443	49802	23.200.0.42	192.168.2.4
Sep 4, 2024 03:36:00.970793962 CEST	49802	443	192.168.2.4	23.200.0.42
Sep 4, 2024 03:36:00.970858097 CEST	443	49802	23.200.0.42	192.168.2.4
Sep 4, 2024 03:36:00.970926046 CEST	49802	443	192.168.2.4	23.200.0.42
Sep 4, 2024 03:36:01.012502909 CEST	443	49802	23.200.0.42	192.168.2.4
Sep 4, 2024 03:36:01.410155058 CEST	443	49802	23.200.0.42	192.168.2.4
Sep 4, 2024 03:36:01.410291910 CEST	443	49802	23.200.0.42	192.168.2.4
Sep 4, 2024 03:36:01.410342932 CEST	49802	443	192.168.2.4	23.200.0.42
Sep 4, 2024 03:36:01.410470963 CEST	49802	443	192.168.2.4	23.200.0.42
Sep 4, 2024 03:36:01.410485983 CEST	443	49802	23.200.0.42	192.168.2.4
Sep 4, 2024 03:36:01.410495996 CEST	49802	443	192.168.2.4	23.200.0.42
Sep 4, 2024 03:36:01.410531044 CEST	49802	443	192.168.2.4	23.200.0.42
Sep 4, 2024 03:36:06.501724005 CEST	49763	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:06.501725912 CEST	49764	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:06.501740932 CEST	443	49763	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:06.501753092 CEST	443	49764	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:07.578658104 CEST	49723	80	192.168.2.4	199.232.210.172
Sep 4, 2024 03:36:07.578730106 CEST	49724	80	192.168.2.4	2.16.100.168
Sep 4, 2024 03:36:07.583781958 CEST	80	49723	199.232.210.172	192.168.2.4
Sep 4, 2024 03:36:07.583973885 CEST	49723	80	192.168.2.4	199.232.210.172
Sep 4, 2024 03:36:07.584171057 CEST	80	49724	2.16.100.168	192.168.2.4
Sep 4, 2024 03:36:07.584228039 CEST	49724	80	192.168.2.4	2.16.100.168
Sep 4, 2024 03:36:12.008649111 CEST	49792	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:12.008675098 CEST	443	49792	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:12.718381882 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:12.718470097 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:12.718522072 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:12.720248938 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:12.720324993 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:12.720366001 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:14.962165117 CEST	63890	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:36:14.967048883 CEST	53	63890	1.1.1.1	192.168.2.4
Sep 4, 2024 03:36:14.967165947 CEST	63890	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:36:14.972029924 CEST	53	63890	1.1.1.1	192.168.2.4
Sep 4, 2024 03:36:15.374651909 CEST	443	49800	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:15.374661922 CEST	443	49801	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:15.374721050 CEST	443	49800	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:15.374721050 CEST	443	49801	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:15.374795914 CEST	49801	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:15.374799967 CEST	49800	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:15.421977997 CEST	63890	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:36:15.427042961 CEST	53	63890	1.1.1.1	192.168.2.4
Sep 4, 2024 03:36:15.427154064 CEST	63890	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:36:32.375844002 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:32.375871897 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:37.406985044 CEST	49768	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:36:37.407000065 CEST	443	49768	142.250.80.110	192.168.2.4
Sep 4, 2024 03:36:37.422636986 CEST	49769	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:36:37.422650099 CEST	443	49769	142.250.80.110	192.168.2.4
Sep 4, 2024 03:36:51.516625881 CEST	49764	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:51.516630888 CEST	49763	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:51.516637087 CEST	443	49764	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:51.516643047 CEST	443	49763	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:57.719465017 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:57.719495058 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:57.726042032 CEST	49797	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:57.726048946 CEST	443	49797	172.64.41.3	192.168.2.4
Sep 4, 2024 03:37:00.375699043 CEST	49801	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:37:00.375699997 CEST	49800	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:37:00.375725031 CEST	443	49800	172.64.41.3	192.168.2.4
Sep 4, 2024 03:37:00.375725985 CEST	443	49801	172.64.41.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 4, 2024 03:34:58.775376081 CEST	53	55072	1.1.1.1	192.168.2.4
Sep 4, 2024 03:34:59.908529997 CEST	51740	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:34:59.908795118 CEST	62185	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:01.280092001 CEST	53	65237	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:01.329287052 CEST	53	49658	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:03.126467943 CEST	58004	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:03.126748085 CEST	53191	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:03.127621889 CEST	51001	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:03.127772093 CEST	57128	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:03.128632069 CEST	50186	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:03.128792048 CEST	50259	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:03.129223108 CEST	63335	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:03.129467964 CEST	64053	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:03.133084059 CEST	53	58004	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:03.133157969 CEST	53	53191	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:03.133948088 CEST	53	51001	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:03.134164095 CEST	53	57128	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:03.135117054 CEST	53	50186	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:03.135247946 CEST	53	50259	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:03.135648966 CEST	53	63335	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:03.135926008 CEST	53	64053	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:03.255146027 CEST	55510	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:03.255990028 CEST	56010	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:03.262742996 CEST	53	55510	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:03.263282061 CEST	53	56010	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:04.815843105 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.129112959 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.258310080 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.258335114 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.258347034 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.258358002 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.279328108 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.286004066 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.286658049 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.286915064 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.287925959 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.288062096 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.383497953 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.383516073 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.383531094 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.383611917 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.384345055 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.384706974 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.424581051 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.424653053 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.436603069 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.519192934 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.547544003 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.550673008 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.550796032 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.646927118 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.648859978 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.648871899 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.649411917 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.852477074 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.852591991 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:05.948790073 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.949858904 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.950333118 CEST	443	63899	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:05.950494051 CEST	63899	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:06.326452971 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.641520977 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.877829075 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.877846003 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.877856970 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.878338099 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.967849016 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.967868090 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:06.968420029 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.968420029 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.969783068 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.969783068 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.970146894 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.970146894 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:06.970264912 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.064927101 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.064939022 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.065967083 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.066030979 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.066358089 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.066582918 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.080332041 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.080746889 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.083247900 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:07.085956097 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:07.181703091 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:13.864351988 CEST	56207	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:13.864501953 CEST	55843	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:13.871014118 CEST	53	56207	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:13.872906923 CEST	53	55843	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:14.590931892 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:14.591088057 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:14.686146021 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:14.716742992 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:14.717026949 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:14.758366108 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:14.799941063 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:14.878151894 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:16.510555983 CEST	53	63415	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:17.516891956 CEST	56185	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:17.517338037 CEST	59790	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:17.517338037 CEST	58491	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:17.517591953 CEST	57288	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:17.523972034 CEST	53	59790	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:17.524036884 CEST	53	56185	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:17.524071932 CEST	53	58491	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:17.525110006 CEST	53	57288	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:17.655406952 CEST	53797	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:17.655714989 CEST	50573	53	192.168.2.4	1.1.1.1
Sep 4, 2024 03:35:17.662427902 CEST	53	50573	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:17.662516117 CEST	53	53797	1.1.1.1	192.168.2.4
Sep 4, 2024 03:35:19.176937103 CEST	138	138	192.168.2.4	192.168.2.255
Sep 4, 2024 03:35:32.001261950 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.311397076 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.456581116 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.456600904 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.456610918 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.456662893 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.456675053 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.457304001 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.459009886 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.459342003 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.459588051 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.460413933 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.557869911 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.557882071 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.557890892 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.557894945 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.558531046 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.558537006 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.558763027 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.560300112 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.592991114 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:32.656249046 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:32.686266899 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:33.695987940 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:33.696290016 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:33.697788954 CEST	52511	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:33.796273947 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:33.796938896 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:33.797178030 CEST	443	62512	162.159.61.3	192.168.2.4
Sep 4, 2024 03:35:33.799691916 CEST	62512	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:35:34.001081944 CEST	52511	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.159243107 CEST	443	52511	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.159264088 CEST	443	52511	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.159275055 CEST	443	52511	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.159286022 CEST	443	52511	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.159297943 CEST	443	52511	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.159765959 CEST	52511	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.161457062 CEST	52511	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.161942959 CEST	52511	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.162044048 CEST	52511	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.162924051 CEST	52511	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.259757996 CEST	443	52511	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.259816885 CEST	443	52511	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.259825945 CEST	443	52511	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.259835958 CEST	443	52511	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.261135101 CEST	443	52511	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.262046099 CEST	443	52511	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.293723106 CEST	52511	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.293817043 CEST	52511	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.324547052 CEST	52511	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:34.391585112 CEST	443	52511	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:34.454930067 CEST	52511	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:35.617099047 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:35.617153883 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:35.660904884 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:35.660937071 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:35.712497950 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:35.730436087 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:35.730570078 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:35.730674028 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:35.756963015 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:35.757203102 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:35.783658981 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:35.783898115 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:35.853543043 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:35.906016111 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:38.315761089 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:38.315834999 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:38.411331892 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:38.427707911 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:38.427721024 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:38.428004026 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:38.454231024 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:35:38.547916889 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:35:57.131577015 CEST	59587	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.440275908 CEST	59587	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.641310930 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.641324043 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.641333103 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.641343117 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.642015934 CEST	59587	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.643157959 CEST	59587	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.643872976 CEST	59587	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.643989086 CEST	59587	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.644201994 CEST	59587	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.644316912 CEST	59587	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.734546900 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.744508028 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.744554043 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.744563103 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.744570971 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.744950056 CEST	59587	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.745028019 CEST	59587	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.746599913 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.748531103 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.748541117 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.748807907 CEST	59587	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:57.843116999 CEST	443	59587	172.64.41.3	192.168.2.4
Sep 4, 2024 03:35:57.875993013 CEST	59587	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:35:59.908498049 CEST	64723	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.219535112 CEST	64723	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.367985010 CEST	443	64723	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.368201971 CEST	443	64723	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.368400097 CEST	443	64723	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.368415117 CEST	443	64723	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.368427038 CEST	443	64723	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.368637085 CEST	64723	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.370261908 CEST	64723	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.370388985 CEST	64723	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.370675087 CEST	64723	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.370769024 CEST	64723	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.473093033 CEST	443	64723	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.473107100 CEST	443	64723	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.473115921 CEST	443	64723	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.473119974 CEST	443	64723	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.473542929 CEST	64723	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.473592997 CEST	64723	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.474318981 CEST	443	64723	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.474519968 CEST	443	64723	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.474689007 CEST	64723	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:00.570714951 CEST	443	64723	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:00.611087084 CEST	64723	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:06.660084963 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:36:06.755275965 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:36:06.755692005 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:36:06.755760908 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:36:06.780648947 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:36:06.781224012 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:36:06.850960016 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:36:06.864294052 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:36:06.864428997 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:36:06.864609957 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:36:06.892688036 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:36:06.984206915 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:36:07.597140074 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:07.597290993 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:07.597623110 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:07.597726107 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:08.000824928 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:08.050930023 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:08.050997972 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:08.051453114 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:08.078948021 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:08.101372004 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:08.101385117 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:08.101396084 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:08.101408958 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:08.101677895 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:08.101747990 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:08.158823013 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:08.188174963 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:08.610374928 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:08.610449076 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:08.610944986 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:08.610981941 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:09.222605944 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:09.222915888 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:09.224041939 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:09.224873066 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:09.224883080 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:09.225011110 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:09.226056099 CEST	53	64303	1.1.1.1	192.168.2.4
Sep 4, 2024 03:36:09.251295090 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:09.300859928 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:36:09.318751097 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:09.318763018 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:09.319541931 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:09.319684982 CEST	51129	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:09.322211981 CEST	443	51129	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:09.410509109 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:36:09.410815001 CEST	60430	443	192.168.2.4	142.250.80.110
Sep 4, 2024 03:36:09.530584097 CEST	443	60430	142.250.80.110	192.168.2.4
Sep 4, 2024 03:36:14.961751938 CEST	53	50578	1.1.1.1	192.168.2.4
Sep 4, 2024 03:36:42.254652023 CEST	55211	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:42.254807949 CEST	55211	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:42.255198002 CEST	55211	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:42.255369902 CEST	55211	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:42.871562004 CEST	443	55211	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:42.871715069 CEST	443	55211	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:42.872076035 CEST	55211	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:42.906821012 CEST	55211	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:42.966375113 CEST	443	55211	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:42.966387987 CEST	443	55211	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:42.966397047 CEST	443	55211	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:42.966406107 CEST	443	55211	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:42.967048883 CEST	55211	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:42.967142105 CEST	55211	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:43.069350004 CEST	443	55211	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:43.069595098 CEST	55211	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:43.166656017 CEST	443	55211	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:43.169341087 CEST	443	55211	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:43.169352055 CEST	443	55211	162.159.61.3	192.168.2.4
Sep 4, 2024 03:36:43.169626951 CEST	55211	443	192.168.2.4	162.159.61.3
Sep 4, 2024 03:36:43.170516014 CEST	61638	443	192.168.2.4	142.250.65.174
Sep 4, 2024 03:36:43.170624971 CEST	61638	443	192.168.2.4	142.250.65.174
Sep 4, 2024 03:36:43.637224913 CEST	443	61638	142.250.65.174	192.168.2.4
Sep 4, 2024 03:36:43.637243986 CEST	443	61638	142.250.65.174	192.168.2.4
Sep 4, 2024 03:36:43.637787104 CEST	61638	443	192.168.2.4	142.250.65.174
Sep 4, 2024 03:36:43.637875080 CEST	61638	443	192.168.2.4	142.250.65.174
Sep 4, 2024 03:36:43.638142109 CEST	61638	443	192.168.2.4	142.250.65.174
Sep 4, 2024 03:36:43.638154030 CEST	61638	443	192.168.2.4	142.250.65.174
Sep 4, 2024 03:36:43.638264894 CEST	61638	443	192.168.2.4	142.250.65.174
Sep 4, 2024 03:36:43.638288021 CEST	61638	443	192.168.2.4	142.250.65.174
Sep 4, 2024 03:36:43.655566931 CEST	443	61638	142.250.65.174	192.168.2.4
Sep 4, 2024 03:36:43.733486891 CEST	443	61638	142.250.65.174	192.168.2.4
Sep 4, 2024 03:36:43.733882904 CEST	443	61638	142.250.65.174	192.168.2.4
Sep 4, 2024 03:36:43.733926058 CEST	443	61638	142.250.65.174	192.168.2.4
Sep 4, 2024 03:36:43.734241009 CEST	443	61638	142.250.65.174	192.168.2.4
Sep 4, 2024 03:36:43.743820906 CEST	61638	443	192.168.2.4	142.250.65.174
Sep 4, 2024 03:36:43.747720957 CEST	443	61638	142.250.65.174	192.168.2.4
Sep 4, 2024 03:36:43.747807980 CEST	443	61638	142.250.65.174	192.168.2.4
Sep 4, 2024 03:36:43.748004913 CEST	61638	443	192.168.2.4	142.250.65.174
Sep 4, 2024 03:36:43.749363899 CEST	443	61638	142.250.65.174	192.168.2.4
Sep 4, 2024 03:36:43.749527931 CEST	443	61638	142.250.65.174	192.168.2.4
Sep 4, 2024 03:36:43.759486914 CEST	61638	443	192.168.2.4	142.250.65.174
Sep 4, 2024 03:36:43.787245035 CEST	61638	443	192.168.2.4	142.250.65.174
Sep 4, 2024 03:36:43.854850054 CEST	443	61638	142.250.65.174	192.168.2.4
Sep 4, 2024 03:36:54.274225950 CEST	63770	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:54.274399042 CEST	63770	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:54.274605036 CEST	63770	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:54.274693966 CEST	63770	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:54.724082947 CEST	443	63770	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:54.724663019 CEST	63770	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:54.751871109 CEST	63770	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:54.817713976 CEST	443	63770	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:54.817728043 CEST	443	63770	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:54.817737103 CEST	443	63770	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:54.817747116 CEST	443	63770	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:54.821167946 CEST	63770	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:54.821247101 CEST	63770	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:55.062760115 CEST	443	63770	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:55.068186998 CEST	63770	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:55.122071028 CEST	443	63770	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:55.157443047 CEST	63770	443	192.168.2.4	172.64.41.3
Sep 4, 2024 03:36:55.162761927 CEST	443	63770	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:55.163520098 CEST	443	63770	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:55.163624048 CEST	443	63770	172.64.41.3	192.168.2.4
Sep 4, 2024 03:36:55.163882017 CEST	63770	443	192.168.2.4	172.64.41.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 4, 2024 03:34:59.908529997 CEST	192.168.2.4	1.1.1.1	0xd8c3	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:34:59.908795118 CEST	192.168.2.4	1.1.1.1	0xd3d8	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Sep 4, 2024 03:35:03.126467943 CEST	192.168.2.4	1.1.1.1	0xfbf4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.126748085 CEST	192.168.2.4	1.1.1.1	0xffb9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 03:35:03.127621889 CEST	192.168.2.4	1.1.1.1	0x1f7f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.127772093 CEST	192.168.2.4	1.1.1.1	0xcadf	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 03:35:03.128632069 CEST	192.168.2.4	1.1.1.1	0xea03	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.128792048 CEST	192.168.2.4	1.1.1.1	0x358f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 03:35:03.129223108 CEST	192.168.2.4	1.1.1.1	0xb32a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.129467964 CEST	192.168.2.4	1.1.1.1	0xcfcc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 03:35:03.255146027 CEST	192.168.2.4	1.1.1.1	0x79c6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.255990028 CEST	192.168.2.4	1.1.1.1	0x6696	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 03:35:13.864351988 CEST	192.168.2.4	1.1.1.1	0x8b3d	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:13.864501953 CEST	192.168.2.4	1.1.1.1	0x4ce	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Sep 4, 2024 03:35:17.516891956 CEST	192.168.2.4	1.1.1.1	0xf80	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:17.517338037 CEST	192.168.2.4	1.1.1.1	0x5985	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 03:35:17.517338037 CEST	192.168.2.4	1.1.1.1	0x3128	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:17.517591953 CEST	192.168.2.4	1.1.1.1	0xebbb	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 03:35:17.655406952 CEST	192.168.2.4	1.1.1.1	0x7021	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:17.655714989 CEST	192.168.2.4	1.1.1.1	0x67d5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 4, 2024 03:34:59.915441036 CEST	1.1.1.1	192.168.2.4	0xd8c3	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:34:59.915674925 CEST	1.1.1.1	192.168.2.4	0xd3d8	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:02.045089006 CEST	1.1.1.1	192.168.2.4	0x4f08	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	s-part-0014.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:02.045089006 CEST	1.1.1.1	192.168.2.4	0x4f08	No error (0)	s-part-0014.t-0009.t-msedge.net		13.107.246.42	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.133084059 CEST	1.1.1.1	192.168.2.4	0xfbf4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.133084059 CEST	1.1.1.1	192.168.2.4	0xfbf4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.133157969 CEST	1.1.1.1	192.168.2.4	0xffb9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 03:35:03.133948088 CEST	1.1.1.1	192.168.2.4	0x1f7f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.133948088 CEST	1.1.1.1	192.168.2.4	0x1f7f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.134164095 CEST	1.1.1.1	192.168.2.4	0xcadf	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 03:35:03.135117054 CEST	1.1.1.1	192.168.2.4	0xea03	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.135117054 CEST	1.1.1.1	192.168.2.4	0xea03	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.135247946 CEST	1.1.1.1	192.168.2.4	0x358f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 03:35:03.135648966 CEST	1.1.1.1	192.168.2.4	0xb32a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.135648966 CEST	1.1.1.1	192.168.2.4	0xb32a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.135926008 CEST	1.1.1.1	192.168.2.4	0xcfcc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 03:35:03.262742996 CEST	1.1.1.1	192.168.2.4	0x79c6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.262742996 CEST	1.1.1.1	192.168.2.4	0x79c6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:03.263282061 CEST	1.1.1.1	192.168.2.4	0x6696	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 03:35:13.871014118 CEST	1.1.1.1	192.168.2.4	0x8b3d	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:13.871014118 CEST	1.1.1.1	192.168.2.4	0x8b3d	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:13.872906923 CEST	1.1.1.1	192.168.2.4	0x4ce	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:14.493017912 CEST	1.1.1.1	192.168.2.4	0x6f01	No error (0)	shed.dual-low.s-part-0029.t-0009.t-msedge.net	s-part-0029.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:14.493017912 CEST	1.1.1.1	192.168.2.4	0x6f01	No error (0)	s-part-0029.t-0009.t-msedge.net		13.107.246.57	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:15.083695889 CEST	1.1.1.1	192.168.2.4	0xafe1	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:15.083695889 CEST	1.1.1.1	192.168.2.4	0xafe1	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:15.083708048 CEST	1.1.1.1	192.168.2.4	0x83a0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:16.103142023 CEST	1.1.1.1	192.168.2.4	0x8140	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:16.133735895 CEST	1.1.1.1	192.168.2.4	0xeec9	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:16.133735895 CEST	1.1.1.1	192.168.2.4	0xeec9	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:17.523972034 CEST	1.1.1.1	192.168.2.4	0x5985	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 03:35:17.524036884 CEST	1.1.1.1	192.168.2.4	0xf80	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:17.524036884 CEST	1.1.1.1	192.168.2.4	0xf80	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:17.524071932 CEST	1.1.1.1	192.168.2.4	0x3128	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:17.524071932 CEST	1.1.1.1	192.168.2.4	0x3128	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:17.525110006 CEST	1.1.1.1	192.168.2.4	0xebbb	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 03:35:17.662427902 CEST	1.1.1.1	192.168.2.4	0x67d5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 03:35:17.662516117 CEST	1.1.1.1	192.168.2.4	0x7021	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:17.662516117 CEST	1.1.1.1	192.168.2.4	0x7021	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:18.126401901 CEST	1.1.1.1	192.168.2.4	0xcbc0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:18.126401901 CEST	1.1.1.1	192.168.2.4	0xcbc0	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:19.967586040 CEST	1.1.1.1	192.168.2.4	0xcbc0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:19.967586040 CEST	1.1.1.1	192.168.2.4	0xcbc0	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:20.154719114 CEST	1.1.1.1	192.168.2.4	0xcbc0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:20.154719114 CEST	1.1.1.1	192.168.2.4	0xcbc0	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:22.164220095 CEST	1.1.1.1	192.168.2.4	0xcbc0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:22.164220095 CEST	1.1.1.1	192.168.2.4	0xcbc0	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 03:35:26.168569088 CEST	1.1.1.1	192.168.2.4	0xcbc0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 03:35:26.168569088 CEST	1.1.1.1	192.168.2.4	0xcbc0	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
2024-09-04 01:35:32 UTC	162.159.61.3	192.168.2.4	0x0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	true
2024-09-04 01:35:32 UTC	162.159.61.3	192.168.2.4	0x0	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	true

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

clients2.googleusercontent.com

slscr.update.microsoft.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49748	13.107.246.42	443	7484	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:02 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 01:35:02 UTC	531	IN	HTTP/1.1 200 OK Date: Wed, 04 Sep 2024 01:35:02 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 30 Aug 2024 17:05:10 GMT ETag: 0x8DCC915E7CD8385 x-ms-request-id: 1b6aa40f-801e-0039-70c1-fc28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240904T013502Z-165795675767hwjqv3v00bvq340000000aa0000000007bse Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-04 01:35:02 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	13.107.246.42	443	7484	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:02 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 01:35:02 UTC	555	IN	HTTP/1.1 200 OK Date: Wed, 04 Sep 2024 01:35:02 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 3afe9785-e01e-0066-3464-fbda5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240904T013502Z-165795675762gt5gbs4b9bazh800000009zg00000000au2q Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-04 01:35:02 UTC	15829	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-09-04 01:35:02 UTC	16384	IN	Data Raw: c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db b1 Data Ascii: \|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-09-04 01:35:02 UTC	16384	IN	Data Raw: 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 1e Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-09-04 01:35:03 UTC	16384	IN	Data Raw: 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 7d Data Ascii: CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[}
2024-09-04 01:35:03 UTC	5226	IN	Data Raw: b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 c0 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49752	172.64.41.3	443	7484	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 01:35:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 01:35:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 01:35:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bda3da00ddd7cae-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 01:35:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom ))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49753	172.64.41.3	443	7484	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 01:35:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 01:35:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 01:35:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bda3d9fef6743ff-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 01:35:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 03 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49755	162.159.61.3	443	7484	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 01:35:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 01:35:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 01:35:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bda3da02c798c48-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 01:35:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f9 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49754	162.159.61.3	443	7484	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 01:35:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 01:35:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 01:35:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bda3da01f2c1a17-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 01:35:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fc 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49756	172.64.41.3	443	7484	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 01:35:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 01:35:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 01:35:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bda3da0cae641f8-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 01:35:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0f 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49761	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:04 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-04 01:35:04 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=227436 Date: Wed, 04 Sep 2024 01:35:04 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49762	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:05 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-04 01:35:05 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=227489 Date: Wed, 04 Sep 2024 01:35:05 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-04 01:35:05 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49766	142.250.80.110	443	7484	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:06 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-04 01:35:06 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 04 Sep 2024 01:35:06 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49765	142.250.80.110	443	7484	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:06 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-04 01:35:06 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 04 Sep 2024 01:35:06 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49767	142.250.80.68	443	7484	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:06 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-04 01:35:06 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 04 Sep 2024 01:19:49 GMT Expires: Thu, 12 Sep 2024 01:19:49 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 917 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-04 01:35:06 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-04 01:35:06 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-04 01:35:06 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-04 01:35:06 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-04 01:35:06 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49777	142.250.185.65	443	8348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:14 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 01:35:14 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8ljvFkAfGD6T3x8T4YFrQfJobCyIDZeeGVWY9_EIjqMb4CRuA1Od_ViYDskpUy0UL2dPhkS4 X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Tue, 03 Sep 2024 19:26:09 GMT Expires: Wed, 03 Sep 2025 19:26:09 GMT Cache-Control: public, max-age=31536000 Age: 22145 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-04 01:35:14 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-09-04 01:35:14 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-09-04 01:35:14 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-09-04 01:35:14 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-09-04 01:35:14 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-09-04 01:35:14 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-09-04 01:35:14 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-09-04 01:35:14 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-09-04 01:35:14 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-09-04 01:35:14 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49774	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=8lhKy2RR9OdCeRP&MD=3x5MNHL2 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-04 01:35:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c348d7e5-5e9d-4524-a9c1-7ea469271ff0 MS-RequestId: 0f09762c-8bab-4cbe-a069-d439e5c37ce8 MS-CV: fnHEIkkRhk250Cn7.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 04 Sep 2024 01:35:14 GMT Connection: close Content-Length: 24490
2024-09-04 01:35:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-04 01:35:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49779	13.107.246.57	443	8348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:15 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 01:35:15 UTC	552	IN	HTTP/1.1 200 OK Date: Wed, 04 Sep 2024 01:35:15 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 30 Aug 2024 17:05:10 GMT ETag: 0x8DCC915E7CD8385 x-ms-request-id: 1b6aa40f-801e-0039-70c1-fc28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240904T013515Z-16579567576vpzq62mgx0my8kw0000000adg000000006crp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-04 01:35:15 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49787	162.159.61.3	443	8348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 01:35:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 01:35:18 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 01:35:18 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bda3df9ef61c434-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 01:35:18 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ee 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49786	172.64.41.3	443	8348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:17 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 01:35:17 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 01:35:18 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 01:35:18 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bda3dfa0ca0c468-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 01:35:18 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2a 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom*PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49788	162.159.61.3	443	8348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:18 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 01:35:18 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 01:35:18 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 01:35:18 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bda3dfadc36c335-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 01:35:18 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 25 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom%#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49789	162.159.61.3	443	8348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:32 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 01:35:32 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 2f 00 0c 00 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcom)/+
2024-09-04 01:35:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 01:35:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bda3e545b987c7b-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 01:35:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 07 00 00 00 01 10 6d 73 65 64 67 65 65 78 74 65 6e 73 69 6f 6e 73 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d d6 00 34 04 73 74 61 72 02 73 66 03 74 6c 75 02 64 6c 08 64 65 6c 69 76 65 72 79 02 6d 70 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 08 64 65 6c 69 76 65 72 79 c0 33 c0 52 00 05 00 01 00 01 51 46 00 26 11 63 64 70 2d 66 2d 73 73 6c 2d 74 6c 75 2d 6e 65 74 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 03 6e 65 74 00 c0 92 00 05 00 01 00 00 00 f2 00 1c 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 09 61 7a 75 72 65 65 64 67 65 c0 b3 c0 c4 00 05 00 01 00 00 06 ce 00 15 0f 77 69 6c 64 63 61 72 64 74 6c 75 2d 73 73 6c 02 65 63 Data Ascii: msedgeextensionssftludldeliverympmicrosoftcom4starsftludldeliverympmicrosoftcomdelivery3RQF&cdp-f-ssl-tlu-nettrafficmanagernetwildcardtlu-sslazureedgewildcardtlu-sslec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49791	152.195.19.97	443	8348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:33 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726018514&P2=404&P3=2&P4=cCm1VOkQHgylfQTH06%2f5kk5ejgQF4aFN6fpnGIsk2Vj5la5mS1D%2f51bDg3cLVdtCuhLe8QHJ%2fevbL9jub6hRJg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 5Oc92+fjJdbQg+QOuqbgXe Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 01:35:33 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5340264 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 04 Sep 2024 01:35:33 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-09-04 01:35:33 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49793	172.64.41.3	443	8348	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 01:35:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-09-04 01:35:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 01:35:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bda3e5f19fb424c-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 01:35:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0d ee 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 1a 00 02 c0 43 c0 43 00 01 00 01 00 00 00 1a 00 04 cc 4f c5 ef c0 43 00 01 00 01 00 00 00 1a 00 04 0d 6b 15 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet0CCOCk)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49796	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:35:53 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=8lhKy2RR9OdCeRP&MD=3x5MNHL2 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-04 01:35:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 084d895b-496d-4d63-9ea9-1f993a15d4f6 MS-RequestId: b7ead9fe-6e7e-4be6-8963-452f778f30a5 MS-CV: TuyAPGQYiUme4i7j.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 04 Sep 2024 01:35:52 GMT Connection: close Content-Length: 30005
2024-09-04 01:35:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-04 01:35:53 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49802	23.200.0.42	443	7484	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 01:36:00 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 01:36:01 UTC	378	IN	HTTP/1.1 503 Service Unavailable Content-Length: 326 Content-Type: text/html; charset=us-ascii Date: Wed, 04 Sep 2024 01:36:01 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.2aac2d17.1725413761.9851898 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-09-04 01:36:01 UTC	326	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><

Target ID:	0
Start time:	21:34:54
Start date:	03/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x4a0000
File size:	917'504 bytes
MD5 hash:	7A10FEE1036074D25E1E08D620DB8FB3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	21:34:54
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:34:55
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=2032,i,8905798674714818459,6324943101716542901,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:34:55
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:34:55
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	21:35:00
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6892 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:35:00
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7072 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	21:35:00
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff7dff00000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	21:35:00
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2216,i,3457206950265630416,17074384450217577819,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff7dff00000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	21:35:10
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	21:35:11
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3088 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	21:35:11
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4216 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:35:13
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6036 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:8
Imagebase:	0x7ff7dff00000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	21:35:13
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6036 --field-trial-handle=2060,i,9664755091412053719,3476500552782462935,262144 /prefetch:8
Imagebase:	0x7ff7dff00000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	21:35:18
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	21:35:19
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2096,i,4050729052330294254,10800407992957941430,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	21:35:27
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	21:35:27
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=948 --field-trial-handle=2020,i,1714544722579944857,5177159478557245904,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	21:35:40
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	21:35:41
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2136,i,12101667890318184376,6573158094863645927,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.9%
Total number of Nodes:	1396
Total number of Limit Nodes:	43

Executed Functions

Function 004A42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 004A430D

Part of subcall function 004A6B57: _wcslen.LIBCMT ref: 004A6B6A

GetCurrentProcess.KERNEL32(?,0053CB64,00000000,?,?), ref: 004A4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 004A4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 004A4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 004A4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 004A4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 004A447B
GetSystemInfo.KERNEL32(?,?,?), ref: 004A44A0

Strings

|O, xrefs: 004E36F8
kernel32.dll, xrefs: 004A444F
GetNativeSystemInfo, xrefs: 004A4460

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 9ba754613ef61da48530283de08c7b1ab1ea68cf9dc65d72ca84ad6c2af4620a
Instruction ID: f1b17dc3ac0bd3101752a8e6de6e7e17edc01f46627b67af4cbbbb61e3f23cc8
Opcode Fuzzy Hash: 9ba754613ef61da48530283de08c7b1ab1ea68cf9dc65d72ca84ad6c2af4620a
Instruction Fuzzy Hash: 0BA1F46190AAD0CFC722CF7D7C441993FA46BB6342B144C9AE08C97B61D268458DFB2E

Function 004A42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,004A50AA,?,?,00000000,00000000), ref: 004A42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,004A50AA,?,?,00000000,00000000), ref: 004A42C9
LoadResource.KERNEL32(?,00000000,?,?,004A50AA,?,?,00000000,00000000,?,?,?,?,?,?,004A4F20), ref: 004E35BE
SizeofResource.KERNEL32(?,00000000,?,?,004A50AA,?,?,00000000,00000000,?,?,?,?,?,?,004A4F20), ref: 004E35D3
LockResource.KERNEL32(004A50AA,?,?,004A50AA,?,?,00000000,00000000,?,?,?,?,?,?,004A4F20,?), ref: 004E35E6

Strings

SCRIPT, xrefs: 004A42BF

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 8db060ede86dbac02a3aaa05d412330d1d606582ea438ec744ed5dca66e96ed2
Instruction ID: 831b7e1b2b45b1998f080b0eba292b158958855ba80c1b1727f0ccbe82c5549d
Opcode Fuzzy Hash: 8db060ede86dbac02a3aaa05d412330d1d606582ea438ec744ed5dca66e96ed2
Instruction Fuzzy Hash: 48117C76240700BFD7218BA5DC48F2B7FB9EBD6B91F1081AAF402E6290DBB1D8049720

Function 004E2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 004A2B6B

Part of subcall function 004A3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00571418,?,004A2E7F,?,?,?,00000000), ref: 004A3A78

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00562224), ref: 004E2C10
ShellExecuteW.SHELL32(00000000,?,?,00562224), ref: 004E2C17

Strings

runas, xrefs: 004E2C0B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 47c49219c56bd0293f65179a3a9876aac43cdf200167c0438f73c513c4139105
Instruction ID: 7af89389b7ee9ffa576f76cf187c017bbe8ce45e525500de7e7217099fe69dd1
Opcode Fuzzy Hash: 47c49219c56bd0293f65179a3a9876aac43cdf200167c0438f73c513c4139105
Instruction Fuzzy Hash: 5E1124311083415BCB04FF2AE8519BE7BA4ABB7349F04442FF046131A2DF6C9A0EE71A

Function 0050DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,004E5222), ref: 0050DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0050DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0050DBEE
FindClose.KERNEL32(00000000), ref: 0050DBFA

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: f45303fbec2bd5dabcfee42c0239059dc0d3577df619a0f10c4c23d9060e87af
Instruction ID: f90c8514a5d436b908a2d7a6a62028dac96a96f475aea42fb41ec6634af4dee4
Opcode Fuzzy Hash: f45303fbec2bd5dabcfee42c0239059dc0d3577df619a0f10c4c23d9060e87af
Instruction Fuzzy Hash: 2CF0A03181092057D2206BB8AC0D8AF3F7CBF41334B104702F876D22E0EBB05D58DAA5

Function 0052AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0052B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0052B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0052B1D4
_wcslen.LIBCMT ref: 0052B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0052B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0052B236
_wcslen.LIBCMT ref: 0052B332

Part of subcall function 005105A7: GetStdHandle.KERNEL32(000000F6), ref: 005105C6

_wcslen.LIBCMT ref: 0052B34B
_wcslen.LIBCMT ref: 0052B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0052B3B6
GetLastError.KERNEL32(00000000), ref: 0052B407
CloseHandle.KERNEL32(?), ref: 0052B439
CloseHandle.KERNEL32(00000000), ref: 0052B44A
CloseHandle.KERNEL32(00000000), ref: 0052B45C
CloseHandle.KERNEL32(00000000), ref: 0052B46E
CloseHandle.KERNEL32(?), ref: 0052B4E3

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 24783481fd96812672fc17383dbfb8c1adc9866cb0fc44f41bdec9aaad7d12d3
Instruction ID: 76ddd686d60b19f1673ed13a3f7505597f5142358565f80d73472b4d1774c962
Opcode Fuzzy Hash: 24783481fd96812672fc17383dbfb8c1adc9866cb0fc44f41bdec9aaad7d12d3
Instruction Fuzzy Hash: A0F1AC315043109FD724EF25D895B6ABBE1BF86314F14885EF8958B2A2CB35EC44CB92

Function 004AD730 Relevance: 21.6, APIs: 14, Instructions: 627windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 004AD807
timeGetTime.WINMM ref: 004ADA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004ADB28
TranslateMessage.USER32(?), ref: 004ADB7B
DispatchMessageW.USER32(?), ref: 004ADB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004ADB9F
Sleep.KERNELBASE(0000000A), ref: 004ADBB1

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: eeebe75df205936db2341f38c68ddc81d39f244125b33ea2aac1be975a0cadf1
Instruction ID: 0558248c1314f5f21dbe213e45e17cd89fcdda0b51efa97fa43a82ef23f00507
Opcode Fuzzy Hash: eeebe75df205936db2341f38c68ddc81d39f244125b33ea2aac1be975a0cadf1
Instruction Fuzzy Hash: 99421170A04245DFD728CF24C844BBBBBA4BF66304F04451FE556877A1D7B8E884DB9A

Function 004A2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 004A2D07
RegisterClassExW.USER32(00000030), ref: 004A2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004A2D42
InitCommonControlsEx.COMCTL32(?), ref: 004A2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004A2D6F
LoadIconW.USER32(000000A9), ref: 004A2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 004A2D94

Strings

0, xrefs: 004A2CE9
+, xrefs: 004A2CF0
AutoIt v3 GUI, xrefs: 004A2D23
TaskbarCreated, xrefs: 004A2D37

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: cac9fdc5912f7a31f36abffce4b19c1ed5461000d88661d2621066e12faec3f9
Instruction ID: a835218b24c6b3e72c69c7daf50eaf12af8193bca4031c379a9487ea86d89e11
Opcode Fuzzy Hash: cac9fdc5912f7a31f36abffce4b19c1ed5461000d88661d2621066e12faec3f9
Instruction Fuzzy Hash: 8521E4B5911208AFDB00DFA8E849BDDBFB4FB18700F00411AFA15B63A0D7B54588AFA4

Function 004E065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004E039A: CreateFileW.KERNELBASE(00000000,00000000,?,004E0704,?,?,00000000,?,004E0704,00000000,0000000C), ref: 004E03B7

GetLastError.KERNEL32 ref: 004E076F
__dosmaperr.LIBCMT ref: 004E0776
GetFileType.KERNELBASE(00000000), ref: 004E0782
GetLastError.KERNEL32 ref: 004E078C
__dosmaperr.LIBCMT ref: 004E0795
CloseHandle.KERNEL32(00000000), ref: 004E07B5
CloseHandle.KERNEL32(?), ref: 004E08FF
GetLastError.KERNEL32 ref: 004E0931
__dosmaperr.LIBCMT ref: 004E0938

Strings

H, xrefs: 004E08BD

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 82c6a48274c6b9ee2508bad9fb0db37b0d15d30e26a4579cd1ca6999da1a2535
Instruction ID: f7b98b426be347f4dba6d4b4f514fd2923b13efd0c994d739c449a00dedc7ad3
Opcode Fuzzy Hash: 82c6a48274c6b9ee2508bad9fb0db37b0d15d30e26a4579cd1ca6999da1a2535
Instruction Fuzzy Hash: 23A15632A001848FDF19AF79D851BAE3BA0AB06325F14015EF825AB3D1C7798C97DB95

Function 004A344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004A3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00571418,?,004A2E7F,?,?,?,00000000), ref: 004A3A78

Part of subcall function 004A3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 004A3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 004A356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 004E318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 004E31CE
RegCloseKey.ADVAPI32(?), ref: 004E3210
_wcslen.LIBCMT ref: 004E3277
_wcslen.LIBCMT ref: 004E3286

Strings

\, xrefs: 004E328C
Include, xrefs: 004E3184, 004E31C5
Software\AutoIt v3\AutoIt, xrefs: 004A3560
\Include\, xrefs: 004A3527

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 692919ccdd2c5659c38b5a97e46f110d92baf445cc97e6cd1168d2d8e55d55a2
Instruction ID: 61f0a42a2ecadfb36d5e137890b359fc9f8554e7ec3d13b963c0275f0f7a2f75
Opcode Fuzzy Hash: 692919ccdd2c5659c38b5a97e46f110d92baf445cc97e6cd1168d2d8e55d55a2
Instruction Fuzzy Hash: EB7195714043009EC314DF66EC4595BBBE8FFA5744F40482FF589971A0EB789A88EB55

Function 004A2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 004A2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 004A2B9D
LoadIconW.USER32(00000063), ref: 004A2BB3
LoadIconW.USER32(000000A4), ref: 004A2BC5
LoadIconW.USER32(000000A2), ref: 004A2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 004A2BEF
RegisterClassExW.USER32(?), ref: 004A2C40

Part of subcall function 004A2CD4: GetSysColorBrush.USER32(0000000F), ref: 004A2D07
Part of subcall function 004A2CD4: RegisterClassExW.USER32(00000030), ref: 004A2D31
Part of subcall function 004A2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004A2D42
Part of subcall function 004A2CD4: InitCommonControlsEx.COMCTL32(?), ref: 004A2D5F
Part of subcall function 004A2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004A2D6F
Part of subcall function 004A2CD4: LoadIconW.USER32(000000A9), ref: 004A2D85
Part of subcall function 004A2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 004A2D94

Strings

0, xrefs: 004A2C0F
#, xrefs: 004A2C16
AutoIt v3, xrefs: 004A2C2F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 1215aacba122c11196d7048110f5dd137ff4eef113c8fc169c7dc0a44f324c34
Instruction ID: 694cf8a6f11969d23634c0cb5bcf9832a9f478df385b978f93f0eeff35f044c5
Opcode Fuzzy Hash: 1215aacba122c11196d7048110f5dd137ff4eef113c8fc169c7dc0a44f324c34
Instruction Fuzzy Hash: A2213A71E00714ABDB109FAAFC45A997FB4FB18B50F00441AE508A67A0D3B50588FF98

Function 004AB710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004ABB4E

Strings

x#W, xrefs: 004F0207
p%W, xrefs: 004AB8DC
p#W, xrefs: 004F0263
p#W, xrefs: 004F024F
p%W, xrefs: 004ABB32
p#W, xrefs: 004ABA72
x#W, xrefs: 004F0168
p#W, xrefs: 004ABB6B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: p#W$p#W$p#W$p#W$p%W$p%W$x#W$x#W
API String ID: 1385522511-984853578
Opcode ID: 75136c37230ab646ac2e7a96f31f133b5cdd31ffc755b57747a7db9e03f74447
Instruction ID: 87105862deeb24a94ecf4eb43dfd42c6e3fc7e684859162857aacd6de523cb9b
Opcode Fuzzy Hash: 75136c37230ab646ac2e7a96f31f133b5cdd31ffc755b57747a7db9e03f74447
Instruction Fuzzy Hash: 8F32C074A002099FDB10CF54C894ABBB7B9FF95304F14805AEA05AB352C77CAD81DBA9

Function 004A3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,004A316A,?,?), ref: 004A31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,004A316A,?,?), ref: 004A3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 004A3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,004A316A,?,?), ref: 004A3232
CreatePopupMenu.USER32 ref: 004A3246
PostQuitMessage.USER32(00000000), ref: 004A3267

Strings

TaskbarCreated, xrefs: 004A322D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 5b2699c5e7a074419c156614b3c5c2479053b035ad744d144e8fd0077b2ab728
Instruction ID: 6e1780f8d0e0829c55480b77f2ebfe38a00c4cba537e983dd9ca569ce7b42e6c
Opcode Fuzzy Hash: 5b2699c5e7a074419c156614b3c5c2479053b035ad744d144e8fd0077b2ab728
Instruction Fuzzy Hash: 4B414A32240200A7DB141F7CAD0EB7A3E59E777346F04411BF906953A1EB6C9E45B76E

Function 004A2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 004A2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 004A2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,004A1CAD,?), ref: 004A2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,004A1CAD,?), ref: 004A2CCF

Strings

edit, xrefs: 004A2CAC
AutoIt v3, xrefs: 004A2C89, 004A2C8E, 004A2C8F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 7e2de529a3abca172343c465645e4ba84eb7b121c42b6c0b38cb08e635e3e59a
Instruction ID: 3e93cea0217940c2ea01dd6d146e5bb0ca8f9fc350affbf2a8c3a9bd133817b2
Opcode Fuzzy Hash: 7e2de529a3abca172343c465645e4ba84eb7b121c42b6c0b38cb08e635e3e59a
Instruction Fuzzy Hash: CEF030765403907AE730072B7C09E773EBDD7D6F50F01045DF908A2260C6611888FA74

Function 0050E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0050E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0050E9A5
Sleep.KERNEL32(00000000), ref: 0050E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0050E9B7
Sleep.KERNELBASE ref: 0050E9F3

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 83e641925176222bd9b8262553053b5b1c53dbe9cbd0b5f0f5924d7bb32ef9c7
Instruction ID: 3da9d9d9866f507d54a897f9fa2fde30de0e93fc4f1236b8dcc9ba92477a9e7b
Opcode Fuzzy Hash: 83e641925176222bd9b8262553053b5b1c53dbe9cbd0b5f0f5924d7bb32ef9c7
Instruction Fuzzy Hash: DA015731C01629DBCF00ABE5D95AAEDBF78BB18301F100946E502B2291CB309658EBA1

Function 004A3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,004A3B0F,SwapMouseButtons,00000004,?), ref: 004A3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,004A3B0F,SwapMouseButtons,00000004,?), ref: 004A3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,004A3B0F,SwapMouseButtons,00000004,?), ref: 004A3B83

Strings

Control Panel\Mouse, xrefs: 004A3B3E

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: e7360d752c37c4dad5da263c24d5bc080f294d1e10b126dc827ef11abd4f6b45
Instruction ID: 04ab529446f7a4bc03a1ff28e248d95522200585f980fe20f3e325eb143b2015
Opcode Fuzzy Hash: e7360d752c37c4dad5da263c24d5bc080f294d1e10b126dc827ef11abd4f6b45
Instruction Fuzzy Hash: D0115AB5510208FFDB208FA4DC88AAFBBB9EF11745B10445AB801E7211E335AE44A764

Function 004A3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 004E33A2

Part of subcall function 004A6B57: _wcslen.LIBCMT ref: 004A6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 004A3A04

Strings

Line: , xrefs: 004E33EB

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 1c894ed1748cafa7dde40bacccb626146dd944344167035ea9bed298046c92b0
Instruction ID: 57edb716533d742a638eb1c239f53e2f8d71beff18852dbe0918b8276fe81c8d
Opcode Fuzzy Hash: 1c894ed1748cafa7dde40bacccb626146dd944344167035ea9bed298046c92b0
Instruction Fuzzy Hash: 0C310471408300AAC721EF25EC46FDBB7DCAB61719F00491FF49983191EB789A49D7CA

Function 004A2DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 004E2C8C

Part of subcall function 004A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,004A3A97,?,?,004A2E7F,?,?,?,00000000), ref: 004A3AC2

Part of subcall function 004A2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 004A2DC4

Strings

X, xrefs: 004E2C5A
`eV, xrefs: 004E2C85

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`eV
API String ID: 779396738-860154749
Opcode ID: 5457fb08aa746dbd412acfb91caee80dd887562b0e36bc32b5ecd2c7211746ba
Instruction ID: d9c6b706b71d21f80ec4d50a7aea002f1b706d541f2aa87f3f81e691345dd361
Opcode Fuzzy Hash: 5457fb08aa746dbd412acfb91caee80dd887562b0e36bc32b5ecd2c7211746ba
Instruction Fuzzy Hash: BB21C371A00298AFDB01DF99C945BEE7BFCAF59309F00405EE405A7241DBF85A898BA5

Function 004BFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 004C0668

Part of subcall function 004C32A4: RaiseException.KERNEL32(?,?,?,004C068A,?,00571444,?,?,?,?,?,?,004C068A,004A1129,00568738,004A1129), ref: 004C3304

__CxxThrowException@8.LIBVCRUNTIME ref: 004C0685

Strings

Unknown exception, xrefs: 004C0692

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 7c6bde5e481aa92eb84282aa7240a9c42c38dce5c9c46bf3cb266d4c22e0501b
Instruction ID: f6d34fdcb0f845833c6914bf59496475b96254eb388743b23fa724c3986b5e41
Opcode Fuzzy Hash: 7c6bde5e481aa92eb84282aa7240a9c42c38dce5c9c46bf3cb266d4c22e0501b
Instruction Fuzzy Hash: 5EF0283890020CB78F40BA65DC46E9E7B6C6E00304B60453FB818C2591EF79DA1AC698

Function 004A10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 004A1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 004A1BF4
Part of subcall function 004A1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 004A1BFC
Part of subcall function 004A1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 004A1C07
Part of subcall function 004A1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 004A1C12
Part of subcall function 004A1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 004A1C1A
Part of subcall function 004A1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 004A1C22

Part of subcall function 004A1B4A: RegisterWindowMessageW.USER32(00000004,?,004A12C4), ref: 004A1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 004A136A
OleInitialize.OLE32 ref: 004A1388
CloseHandle.KERNEL32(00000000,00000000), ref: 004E24AB

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 3dc8cbb1198706df653d434776f9ef584a9bec22ba86b12ac30bdbc0c142ff50
Instruction ID: 271beffa5c520da87f5378b12f43b8d0ab1ba5aa9cca02147c6ee6bab6d8c716
Opcode Fuzzy Hash: 3dc8cbb1198706df653d434776f9ef584a9bec22ba86b12ac30bdbc0c142ff50
Instruction Fuzzy Hash: B871CBB5921A008EC788EF7EB9466553FE5FBA9344B04822ED00ED7261EB344488FF4D

Function 0050C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 004A3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0050C259
KillTimer.USER32(?,00000001,?,?), ref: 0050C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0050C270

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 8b23ebce530f8797ac771cae5bcbdee3e254b59af751d53bb2cc97733f4a67d9
Instruction ID: 4f576ac4976607fd246c38a4e5e61c52215f044e35db7d0940ab78521e26288a
Opcode Fuzzy Hash: 8b23ebce530f8797ac771cae5bcbdee3e254b59af751d53bb2cc97733f4a67d9
Instruction Fuzzy Hash: 7B31C374904744AFEB328F648855BEBBFECAF17308F00049EE5DAA7281C7745A88DB51

Function 004D86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,004D85CC,?,00568CC8,0000000C), ref: 004D8704
GetLastError.KERNEL32(?,004D85CC,?,00568CC8,0000000C), ref: 004D870E
__dosmaperr.LIBCMT ref: 004D8739

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: da73af89a3782293d3cc3e20ea66ee12e416f3daf23ba0d3e9e6490b30891ede
Instruction ID: 84b41a63f15bfe0d54b98ca2942fe8828722d228e47c8ab406c64b0a47cca2ad
Opcode Fuzzy Hash: da73af89a3782293d3cc3e20ea66ee12e416f3daf23ba0d3e9e6490b30891ede
Instruction Fuzzy Hash: 02018E3260426026D62467356C65B7F2B998B91778F39011FFC089B3D3DEACCC81925C

Function 004ADB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 004ADB7B
DispatchMessageW.USER32(?), ref: 004ADB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004ADB9F
Sleep.KERNELBASE(0000000A), ref: 004ADBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 004F1CC9

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: ad314774ba02cab9a5ef000f014fa71796d62bff9c6758f7493058a6889b761f
Instruction ID: f003ba0ff5d58941765942851dfea43f3e56ed7d251ed3131b016582e6f852e2
Opcode Fuzzy Hash: ad314774ba02cab9a5ef000f014fa71796d62bff9c6758f7493058a6889b761f
Instruction Fuzzy Hash: A2F054306043449BE730C7619C45FEB77ACEB55310F10451AE65A931D0DB38A4489B2A

Function 004B1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004B17F6

Strings

CALL, xrefs: 004B17C6

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 67ab9ba179c5527aa3a452b976b4e89daef579d53e0e90389484ef891f451d17
Instruction ID: eb8fe0d9f2c35a534a0692c59e452f1497fd670d2d0f5a990f4e74cb1195c80c
Opcode Fuzzy Hash: 67ab9ba179c5527aa3a452b976b4e89daef579d53e0e90389484ef891f451d17
Instruction Fuzzy Hash: 3E22AD70608301DFC714DF15C4A0A6ABBF1BF85318F54891EF59A8B361D739E845CBAA

Function 004A3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 004A3908

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 84325f0dafb39c26517ccf961a62d36294d913f719ba2d7899d0b13af9f17548
Instruction ID: 1f4f9d9d5effe39c259cb304a2b094aa2d37f393010403403d4780a47375f1ea
Opcode Fuzzy Hash: 84325f0dafb39c26517ccf961a62d36294d913f719ba2d7899d0b13af9f17548
Instruction Fuzzy Hash: 6831D4705047008FD720EF24D885797BBE8FB59709F00092FF59983340E779AA48DB5A

Function 004BF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 004BF661

Part of subcall function 004AD730: GetInputState.USER32 ref: 004AD807

Sleep.KERNEL32(00000000), ref: 004FF2DE

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 82187cbba3e9b6656f746f745359cb364223ee2a2f26c97bc3c11d7ead3bdb9b
Instruction ID: b56b0c91733c74e2c62c321bdbe139bac68a306cefac667398f4339ac32ce6d1
Opcode Fuzzy Hash: 82187cbba3e9b6656f746f745359cb364223ee2a2f26c97bc3c11d7ead3bdb9b
Instruction Fuzzy Hash: 47F0E231240204AFC300EF29D805B6ABBE4FF26360F00402EE809C7361DB70A804CB94

Function 00532598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00532649

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: e0110c8712431759da34625ea81cd6e5b77ebddee931679b66b34407f689c484
Instruction ID: a7e2a13d323cd9920ee51ca473661a3c37ce7c0eec0f9dc628a221d845d5efb3
Opcode Fuzzy Hash: e0110c8712431759da34625ea81cd6e5b77ebddee931679b66b34407f689c484
Instruction Fuzzy Hash: 4421F274200A16AFD720DF19C8D1976BB99FF45368F54806DE8578B392CB71ED41CB90

Function 005313B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00531420

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 2e8202265893af871e8231a6d624ccbda398cc56b2d868913b23fddf6e5c74d4
Instruction ID: cb69569ec0c8388b210d96c689088d5220f382a4709f3a100b93b94bdc8b5c3e
Opcode Fuzzy Hash: 2e8202265893af871e8231a6d624ccbda398cc56b2d868913b23fddf6e5c74d4
Instruction Fuzzy Hash: AB31D030204602AFDB14EF25C495B69FBA2FF85328F04856DE8164B292DB35EC41CBD4

Function 004A4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 004A4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,004A4EDD,?,00571418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 004A4E9C
Part of subcall function 004A4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 004A4EAE
Part of subcall function 004A4E90: FreeLibrary.KERNEL32(00000000,?,?,004A4EDD,?,00571418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 004A4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00571418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 004A4EFD

Part of subcall function 004A4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,004E3CDE,?,00571418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 004A4E62
Part of subcall function 004A4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 004A4E74
Part of subcall function 004A4E59: FreeLibrary.KERNEL32(00000000,?,?,004E3CDE,?,00571418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 004A4E87

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: cf58a50fd5349cb25ab18d757e5e3e2527dc0655a203850049f80400e2748f78
Instruction ID: 6d7832de1159a0837e755212f3bafcc8c1657eceb9144ec4a4aae97ed79d07cd
Opcode Fuzzy Hash: cf58a50fd5349cb25ab18d757e5e3e2527dc0655a203850049f80400e2748f78
Instruction Fuzzy Hash: 80110832600205AACB10AF62D806FEE77A4AFE5715F10441FF452A71C1DEB8AA059758

Function 004D8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 004D8440

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 46ebb538be9934823eb1574db4ddd91eb34233cfb464b8ff4534902f48b15eca
Instruction ID: 2cef3d5bcf4a873c33c7a0dfb06f2f78bbeee64b11f49177574c0500451ccba8
Opcode Fuzzy Hash: 46ebb538be9934823eb1574db4ddd91eb34233cfb464b8ff4534902f48b15eca
Instruction Fuzzy Hash: 8E11487190410AAFCB05DF58E940AAF7BF4EF48304F10405AF808AB312EB30EA11CBA9

Function 004D5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004D4C7D: RtlAllocateHeap.NTDLL(00000008,004A1129,00000000,?,004D2E29,00000001,00000364,?,?,?,004CF2DE,004D3863,00571444,?,004BFDF5,?), ref: 004D4CBE

_free.LIBCMT ref: 004D506C

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: ee992159468e66cffecfe9ac9091c743e006b55794c174a981d4114e867429e5
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: E40149B22047046BE3328F65D891A5AFBECFB89370F25051FE184933C0EA74A805C7B8

Function 005329BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,005314B5,?), ref: 00532A01

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 326e2b92d84217d52351c961da8db275ab5e279ef5322092e7375c0a52012fe4
Instruction ID: 37624105d0970ee60a8756a2cce98c764553f08a3f1d5ea559c286bcfb8218c8
Opcode Fuzzy Hash: 326e2b92d84217d52351c961da8db275ab5e279ef5322092e7375c0a52012fe4
Instruction Fuzzy Hash: 4901B136300E42AFD325CA2DC454B223F92FBC5314F698468C1478B251DB72FC82CBA0

Function 004CE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 679d3ddea48356fc5d846a3483956e4137d8f23192bf360196fd15c4779e0aed
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: DFF0D63A621A1096C6712A778C15F6B339C9F62338F10072FF421923D2DB7C940285AD

Function 0053149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 005314EB

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 85b104e63dfee54bb1a5ede9501b28a048493585d6d86c646dd7fd04bf232430
Instruction ID: 30af15e22538cc3c7e0a9e0e07af9b442fd16bd09d58afc7fa6ff6924a038627
Opcode Fuzzy Hash: 85b104e63dfee54bb1a5ede9501b28a048493585d6d86c646dd7fd04bf232430
Instruction Fuzzy Hash: FD01D435304A419F9B20CF6AD440826BF95FF95364B54809DE84A8B752D672DD82C794

Function 004D4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,004A1129,00000000,?,004D2E29,00000001,00000364,?,?,?,004CF2DE,004D3863,00571444,?,004BFDF5,?), ref: 004D4CBE

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: be659cd94a2725d9d2967cf5037b592711394260cf5e6d96cf1952cdcbd5853d
Instruction ID: 9568dbe48ccbf1c5d2d70d78cea506b9a1e775403936bacac86e658f2f2bda77
Opcode Fuzzy Hash: be659cd94a2725d9d2967cf5037b592711394260cf5e6d96cf1952cdcbd5853d
Instruction Fuzzy Hash: 77F0BB3161212467DB215F629D15F573749AFD1B61B16412BB815A73C0CB78D8019698

Function 004D3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00571444,?,004BFDF5,?,?,004AA976,00000010,00571440,004A13FC,?,004A13C6,?,004A1129), ref: 004D3852

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b89f6d57ce44dcb73f5686904798b07bb82d05f030cf4d749e3e5767b20af041
Instruction ID: 9ac9737d8f09660636ca5ec9ac4b0e683a3433b9c0c15f30a5ee3060709f2274
Opcode Fuzzy Hash: b89f6d57ce44dcb73f5686904798b07bb82d05f030cf4d749e3e5767b20af041
Instruction Fuzzy Hash: 70E0E53510022456DA213E779C24F9B3ACAAB827B2F09003BBC04967C0CB5DDD01B2EF

Function 004A4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00571418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 004A4F6D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 01992dc6a3ae51c4ff220bd4f384bc761bf615e7a2c28618a573f352d5672394
Instruction ID: 739a743e2c4d44fdca7c8cf31559c6d4ca6f3e4ce78ecf27d5e0701333fb0755
Opcode Fuzzy Hash: 01992dc6a3ae51c4ff220bd4f384bc761bf615e7a2c28618a573f352d5672394
Instruction Fuzzy Hash: 59F0A071105341CFCB348F20D49081ABBE0AFA9319320997FF1DA82610C7B99844EF09

Function 00532A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00532A66

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 1112b00152da18e615bd6d1b65ff8981f1bd5d0dda241f272be1b1a1dd4f34a9
Instruction ID: febf5ab753f2eca784769abd9e49cd3d1e032399de5cab78b6b0420f930896ce
Opcode Fuzzy Hash: 1112b00152da18e615bd6d1b65ff8981f1bd5d0dda241f272be1b1a1dd4f34a9
Instruction Fuzzy Hash: E1E0DF32350516ABC710EA30EC848FE7F5CFF90390F000936EC16C2140DB30899586A0

Function 004A2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 004A2DC4

Part of subcall function 004A6B57: _wcslen.LIBCMT ref: 004A6B6A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 0210e1e74c09537be1e977afa640b367613136c2092213b1558013c13e1e3fed
Instruction ID: 22cceea77d1615fd13eab62278083f4d04b84f9fdbce6240520ba176be715261
Opcode Fuzzy Hash: 0210e1e74c09537be1e977afa640b367613136c2092213b1558013c13e1e3fed
Instruction Fuzzy Hash: E7E0CD76A001345BC71192599C05FDA77DDDFC8794F050076FD0AE7258D974AD848694

Function 004A2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004A3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 004A3908

Part of subcall function 004AD730: GetInputState.USER32 ref: 004AD807

SetCurrentDirectoryW.KERNEL32(?), ref: 004A2B6B

Part of subcall function 004A30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 004A314E

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 6af96eda8acaee2c098bff109d1d3f2ac7d1b4da8a123d7fee6401347bc48396
Instruction ID: d9b68f80771a2899ce86725f1d64a2c4c8b988c0b3d63f4883e1e4d844ae7484
Opcode Fuzzy Hash: 6af96eda8acaee2c098bff109d1d3f2ac7d1b4da8a123d7fee6401347bc48396
Instruction Fuzzy Hash: 3FE0262230420407CA08BF3AA8124BDA78A9BF335AF00543FF047432A2DE2C49495329

Function 00503D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00503D18

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: b097d1d5d677c6ae4a60a54ff43ed2228bc27003f4a1230c66e1742091719624
Instruction ID: cb5581e6a825b4e01d152ff73f54b8035430e9208615db7c51026bd0fe51b681
Opcode Fuzzy Hash: b097d1d5d677c6ae4a60a54ff43ed2228bc27003f4a1230c66e1742091719624
Instruction Fuzzy Hash: BFD08CF06A03087EFB0083718C0BEBB379CC326E81F004BA47E02E65C1D9A0DE080230

Function 004E039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,004E0704,?,?,00000000,?,004E0704,00000000,0000000C), ref: 004E03B7

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0435c3ad31bbcb1c3b24d7eec8b779902c4ce7cb8afeaf3acc018b4d7cf69bed
Instruction ID: e72a7749607ed2b2b752980436996ba84b587b152b48e4d11e984cbef029ef8d
Opcode Fuzzy Hash: 0435c3ad31bbcb1c3b24d7eec8b779902c4ce7cb8afeaf3acc018b4d7cf69bed
Instruction Fuzzy Hash: 4AD06C3204010DBBDF028F84DD06EDA3FAAFB48714F014000BE1866120C732E821EB90

Function 004A1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 004A1CBC

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 7059e0ddfe48d5c1213138bdcff4be54a1c4b9d1a187dfaffaf4e0a75e12b5cb
Instruction ID: ba01ca298d74cd90e0bdd423289a9654568e807a71259cd8312742421b9ef8aa
Opcode Fuzzy Hash: 7059e0ddfe48d5c1213138bdcff4be54a1c4b9d1a187dfaffaf4e0a75e12b5cb
Instruction Fuzzy Hash: 9AC09236280304EFF2148B94BC4EF107B64A368B01F048401F64DA96E3C3A228A8FB64

Non-executed Functions

Function 00539576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 004B9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0053961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0053965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0053969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 005396C9
SendMessageW.USER32 ref: 005396F2
GetKeyState.USER32(00000011), ref: 0053978B
GetKeyState.USER32(00000009), ref: 00539798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 005397AE
GetKeyState.USER32(00000010), ref: 005397B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 005397E9
SendMessageW.USER32 ref: 00539810
SendMessageW.USER32(?,00001030,?,00537E95), ref: 00539918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0053992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00539941
SetCapture.USER32(?), ref: 0053994A
ClientToScreen.USER32(?,?), ref: 005399AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 005399BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 005399D6
ReleaseCapture.USER32 ref: 005399E1
GetCursorPos.USER32(?), ref: 00539A19
ScreenToClient.USER32(?,?), ref: 00539A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00539A80
SendMessageW.USER32 ref: 00539AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00539AEB
SendMessageW.USER32 ref: 00539B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00539B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00539B4A
GetCursorPos.USER32(?), ref: 00539B68
ScreenToClient.USER32(?,?), ref: 00539B75
GetParent.USER32(?), ref: 00539B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00539BFA
SendMessageW.USER32 ref: 00539C2B
ClientToScreen.USER32(?,?), ref: 00539C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00539CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00539CDE
SendMessageW.USER32 ref: 00539D01
ClientToScreen.USER32(?,?), ref: 00539D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00539D82

Part of subcall function 004B9944: GetWindowLongW.USER32(?,000000EB), ref: 004B9952

GetWindowLongW.USER32(?,000000F0), ref: 00539E05

Strings

@GUI_DRAGID, xrefs: 0053997D
p#W, xrefs: 00539990
F, xrefs: 00539D07

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#W
API String ID: 3429851547-503726554
Opcode ID: 4936d990b89f1eed6ffef948e8871dbad10c4a851d0b238b4cca1bad09f7373d
Instruction ID: 90016a6284dd188761dd996f5d3a316ffd3c61a52ccbde6f0c801f007f15cc6b
Opcode Fuzzy Hash: 4936d990b89f1eed6ffef948e8871dbad10c4a851d0b238b4cca1bad09f7373d
Instruction Fuzzy Hash: 6C42BEB5205200AFDB20CF28CC45EAABFE5FF59310F100A1DF6999B2A1D7B1E854EB51

Function 00534873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 005348F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00534908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00534927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0053494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0053495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0053497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 005349AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 005349D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00534A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00534A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00534A7E
IsMenu.USER32(?), ref: 00534A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00534AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00534B20
GetWindowLongW.USER32(?,000000F0), ref: 00534B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00534BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00534C82
wsprintfW.USER32 ref: 00534CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00534CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00534CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00534D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00534D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00534D5A

Strings

%d/%02d/%02d, xrefs: 00534CA8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 010082bc8262af93bd9029b47938a08202c2e986b2d53b5da41c35f8b1e585e8
Instruction ID: efa3f32bc252282aefe94500a92c36f5032f101df9ec4fc9f3f0cd701c6cb196
Opcode Fuzzy Hash: 010082bc8262af93bd9029b47938a08202c2e986b2d53b5da41c35f8b1e585e8
Instruction Fuzzy Hash: 9B12DD71600214ABEB248F29CC4AFAE7FF8FF45314F144529F916EA2A1DB78A945CF50

Function 004BF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 004BF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004FF474
IsIconic.USER32(00000000), ref: 004FF47D
ShowWindow.USER32(00000000,00000009), ref: 004FF48A
SetForegroundWindow.USER32(00000000), ref: 004FF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004FF4AA
GetCurrentThreadId.KERNEL32 ref: 004FF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004FF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 004FF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 004FF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 004FF4DE
SetForegroundWindow.USER32(00000000), ref: 004FF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 004FF4F6
keybd_event.USER32(00000012,00000000), ref: 004FF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 004FF50B
keybd_event.USER32(00000012,00000000), ref: 004FF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 004FF519
keybd_event.USER32(00000012,00000000), ref: 004FF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 004FF528
keybd_event.USER32(00000012,00000000), ref: 004FF52D
SetForegroundWindow.USER32(00000000), ref: 004FF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 004FF557

Strings

Shell_TrayWnd, xrefs: 004FF46F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 4fd6302af20a17d6040a68b39361be349ab7ffb86a65543aa526ca7d32655ffb
Instruction ID: 1f7db34b7dc6387fa68b126a2b69e510b6a3226b03b2d34981cfd6ea7bd313a9
Opcode Fuzzy Hash: 4fd6302af20a17d6040a68b39361be349ab7ffb86a65543aa526ca7d32655ffb
Instruction Fuzzy Hash: 3D315E71A4021CBBEB206BB55C4AFBF7E6CEF54B50F100066FA01F62D1C6B59D04ABA5

Function 00501201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 005016C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0050170D
Part of subcall function 005016C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0050173A
Part of subcall function 005016C3: GetLastError.KERNEL32 ref: 0050174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00501286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 005012A8
CloseHandle.KERNEL32(?), ref: 005012B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 005012D1
GetProcessWindowStation.USER32 ref: 005012EA
SetProcessWindowStation.USER32(00000000), ref: 005012F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00501310

Part of subcall function 005010BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005011FC), ref: 005010D4
Part of subcall function 005010BF: CloseHandle.KERNEL32(?,?,005011FC), ref: 005010E9

Strings

ZV, xrefs: 00501392
default, xrefs: 0050130B
, xrefs: 0050125A
winsta0, xrefs: 005012CC

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$ZV
API String ID: 22674027-1908597597
Opcode ID: a6ca113e0ce95b4473f2d4644f3ee7df83261722eb409111a0e1e4e01ede7908
Instruction ID: 51eca7b15197c7dfc3920f824bba0d60a6b73913cf8ddabf63e9e62afbfc873e
Opcode Fuzzy Hash: a6ca113e0ce95b4473f2d4644f3ee7df83261722eb409111a0e1e4e01ede7908
Instruction Fuzzy Hash: 7F818871900609ABDF219FA8DC49FEE7FB9FF04704F144129F910B62A0D7758A58DB2A

Function 00500B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005010F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00501114
Part of subcall function 005010F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00500B9B,?,?,?), ref: 00501120
Part of subcall function 005010F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00500B9B,?,?,?), ref: 0050112F
Part of subcall function 005010F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00500B9B,?,?,?), ref: 00501136
Part of subcall function 005010F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0050114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00500BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00500C00
GetLengthSid.ADVAPI32(?), ref: 00500C17
GetAce.ADVAPI32(?,00000000,?), ref: 00500C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00500C6D
GetLengthSid.ADVAPI32(?), ref: 00500C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00500C8C
HeapAlloc.KERNEL32(00000000), ref: 00500C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00500CB4
CopySid.ADVAPI32(00000000), ref: 00500CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00500CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00500D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00500D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00500D45
HeapFree.KERNEL32(00000000), ref: 00500D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00500D55
HeapFree.KERNEL32(00000000), ref: 00500D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00500D65
HeapFree.KERNEL32(00000000), ref: 00500D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00500D78
HeapFree.KERNEL32(00000000), ref: 00500D7F

Part of subcall function 00501193: GetProcessHeap.KERNEL32(00000008,00500BB1,?,00000000,?,00500BB1,?), ref: 005011A1
Part of subcall function 00501193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00500BB1,?), ref: 005011A8
Part of subcall function 00501193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00500BB1,?), ref: 005011B7

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c50ce0bb09918ce5435f98d4be7402d1cf355476ab7e0a252e0fa754d3c2d0f0
Instruction ID: 5e7dfcce16bae18aa8165f8396c65f9b58002619dbe794c18c34d18253c536f3
Opcode Fuzzy Hash: c50ce0bb09918ce5435f98d4be7402d1cf355476ab7e0a252e0fa754d3c2d0f0
Instruction Fuzzy Hash: F371477690020AABDF109FA4DC48BAEBFB8BF14310F144615E915F62D1D775AA09DBB0

Function 0051EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0053CC08), ref: 0051EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0051EB37
GetClipboardData.USER32(0000000D), ref: 0051EB43
CloseClipboard.USER32 ref: 0051EB4F
GlobalLock.KERNEL32(00000000), ref: 0051EB87
CloseClipboard.USER32 ref: 0051EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 0051EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0051EBC9
GetClipboardData.USER32(00000001), ref: 0051EBD1
GlobalLock.KERNEL32(00000000), ref: 0051EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 0051EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0051EC38
GetClipboardData.USER32(0000000F), ref: 0051EC44
GlobalLock.KERNEL32(00000000), ref: 0051EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0051EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0051EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0051ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 0051ECF3
CountClipboardFormats.USER32 ref: 0051ED14
CloseClipboard.USER32 ref: 0051ED59

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 7fc141a89cb5cdbec0c551c46eaffe16eff077aa3439979ab5da938a8d22c4f6
Instruction ID: 25c14456feb5b574d86d3feef183b9851b10a9d8156b1446ee73d7ed0b27bb6d
Opcode Fuzzy Hash: 7fc141a89cb5cdbec0c551c46eaffe16eff077aa3439979ab5da938a8d22c4f6
Instruction Fuzzy Hash: E761E3352043019FE300EF24D88AFAA7FA4BF95714F08455DF856972A1DB31DD89DB62

Function 0051698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 005169BE
FindClose.KERNEL32(00000000), ref: 00516A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00516A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00516A75

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00516AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00516ADF

Strings

%02d, xrefs: 00516C00, 00516C0A, 00516C5A, 00516CAA, 00516CFA, 00516D4A
%4d, xrefs: 00516BB1
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00516B32
%4d%02d%02d%02d%02d%02d, xrefs: 00516B6A
%03d, xrefs: 00516DA2

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 0df802ca85fa2d9ddd5c9d318ce925a1220f92904e0940c20d4e111fdad3ab2e
Instruction ID: 76810c39256175d290ac044bbae3ec6a16100af4962d8fac03d72bf6f42bee4e
Opcode Fuzzy Hash: 0df802ca85fa2d9ddd5c9d318ce925a1220f92904e0940c20d4e111fdad3ab2e
Instruction Fuzzy Hash: B7D14271508300AEC710EBA5CC81EABB7ECBF99708F44491EF589D7191EB78DA48C762

Function 00519642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00519663
GetFileAttributesW.KERNEL32(?), ref: 005196A1
SetFileAttributesW.KERNEL32(?,?), ref: 005196BB
FindNextFileW.KERNEL32(00000000,?), ref: 005196D3
FindClose.KERNEL32(00000000), ref: 005196DE
FindFirstFileW.KERNEL32(*.*,?), ref: 005196FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0051974A
SetCurrentDirectoryW.KERNEL32(00566B7C), ref: 00519768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00519772
FindClose.KERNEL32(00000000), ref: 0051977F
FindClose.KERNEL32(00000000), ref: 0051978F

Strings

*.*, xrefs: 005196F5

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 75dbc26779c6b6bad636f6f515b1eea455fea530dff8283e0fb86878cc58925b
Instruction ID: 695103a025190b3f424aaabeeac536814646afdc304dddd5a0ca1e91cfca9a33
Opcode Fuzzy Hash: 75dbc26779c6b6bad636f6f515b1eea455fea530dff8283e0fb86878cc58925b
Instruction Fuzzy Hash: 3A31C2365002196AEB14AFB5DC18ADE7FACFF4A320F104596F815E31E0DB34DD848B64

Function 0051979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 005197BE
FindNextFileW.KERNEL32(00000000,?), ref: 00519819
FindClose.KERNEL32(00000000), ref: 00519824
FindFirstFileW.KERNEL32(*.*,?), ref: 00519840
SetCurrentDirectoryW.KERNEL32(?), ref: 00519890
SetCurrentDirectoryW.KERNEL32(00566B7C), ref: 005198AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 005198B8
FindClose.KERNEL32(00000000), ref: 005198C5
FindClose.KERNEL32(00000000), ref: 005198D5

Part of subcall function 0050DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0050DB00

Strings

*.*, xrefs: 0051983B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 976bff3f92453a66e3524c700e0092f4aeea22b1581004ef1f5b7373702f97ab
Instruction ID: d7da3218893f4a9f7a706d40b77801102955bd3f914d87b604bb165b27ca4f36
Opcode Fuzzy Hash: 976bff3f92453a66e3524c700e0092f4aeea22b1581004ef1f5b7373702f97ab
Instruction Fuzzy Hash: F231B2365002197AEB10AFA4DC58ADE7FACBF46324F1045AAF854A31A0DB30D9898B64

Function 0052BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0052C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0052B6AE,?,?), ref: 0052C9B5
Part of subcall function 0052C998: _wcslen.LIBCMT ref: 0052C9F1
Part of subcall function 0052C998: _wcslen.LIBCMT ref: 0052CA68
Part of subcall function 0052C998: _wcslen.LIBCMT ref: 0052CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0052BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0052BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0052BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0052C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0052C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0052C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0052C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0052C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0052C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0052C382
RegCloseKey.ADVAPI32(00000000), ref: 0052C38F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: d6d7d836e9487de73d7a0d93183ddaffb0812824fe84d8d15c0d5f314b5e4187
Instruction ID: d2ed7e089b204fbf52ef8eeec1015c39b873ef575303466639ea35f146eb0fd9
Opcode Fuzzy Hash: d6d7d836e9487de73d7a0d93183ddaffb0812824fe84d8d15c0d5f314b5e4187
Instruction Fuzzy Hash: CE025D71604210AFD714DF24D895E2ABBE5FF9A308F18889DF84ADB2A2D731EC45CB51

Function 00518195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00518257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00518267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00518273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00518310
SetCurrentDirectoryW.KERNEL32(?), ref: 00518324
SetCurrentDirectoryW.KERNEL32(?), ref: 00518356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0051838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00518395

Strings

*.*, xrefs: 0051839B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 99afc36fc2cc3e466a070549651c0a27aa2d763507af3b9ba4ca884e3d17a8f1
Instruction ID: e9b91e035d87b77afc9b34c354d887aa9e9f46f4edbe65fc1a48d51bc4d09906
Opcode Fuzzy Hash: 99afc36fc2cc3e466a070549651c0a27aa2d763507af3b9ba4ca884e3d17a8f1
Instruction Fuzzy Hash: 1861AB76504305AFD720EF21C8809AEB7E8FF89318F048D1EF99983251DB35E949CB92

Function 0050D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,004A3A97,?,?,004A2E7F,?,?,?,00000000), ref: 004A3AC2

Part of subcall function 0050E199: GetFileAttributesW.KERNEL32(?,0050CF95), ref: 0050E19A

FindFirstFileW.KERNEL32(?,?), ref: 0050D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0050D1DD
MoveFileW.KERNEL32(?,?), ref: 0050D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0050D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0050D237

Part of subcall function 0050D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0050D21C,?,?), ref: 0050D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0050D253
FindClose.KERNEL32(00000000), ref: 0050D264

Strings

\*.*, xrefs: 0050D0CD, 0050D0D6, 0050D0EB

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: d35195cbb3c9668b81b1c11f30403ccbc36886339011bacd4216c2bb59f4f186
Instruction ID: 6475240dc5f731d532aa4c80d28fb5a51889b279431028e5eb9b286db18b4d10
Opcode Fuzzy Hash: d35195cbb3c9668b81b1c11f30403ccbc36886339011bacd4216c2bb59f4f186
Instruction Fuzzy Hash: CB617E35C0111EAACF05EBE1CA929EEBBB5BF65344F24406AF40277191EB346F09DB64

Function 0051ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0051ED91
EmptyClipboard.USER32 ref: 0051ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0051EDAC
CloseClipboard.USER32 ref: 0051EEA3

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 746ebf1e26338d08025733ed4b42b7fb1805f5b4e533c817e4eabcc171e46094
Instruction ID: 578258706a8f3439e159d86198260ab1d5b57bf30194093fadee315a1cfd996e
Opcode Fuzzy Hash: 746ebf1e26338d08025733ed4b42b7fb1805f5b4e533c817e4eabcc171e46094
Instruction Fuzzy Hash: 4D41AE35204611AFE310CF29E88AB59BFE5BF54318F14C49DE8199B7A2C735EC81CB90

Function 0050E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 005016C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0050170D
Part of subcall function 005016C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0050173A
Part of subcall function 005016C3: GetLastError.KERNEL32 ref: 0050174A

ExitWindowsEx.USER32(?,00000000), ref: 0050E932

Strings

, xrefs: 0050E920
SeShutdownPrivilege, xrefs: 0050E902
, xrefs: 0050E95C
@, xrefs: 0050E925

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: d8f94234f2ea14d40081241c1f8e4ea98f2e1c7578b51def9fa340050ec8fdb1
Instruction ID: ea45bc578120b4097be95690c0f6d24f16bf46183f4eca0ff3ae67cde4b87d85
Opcode Fuzzy Hash: d8f94234f2ea14d40081241c1f8e4ea98f2e1c7578b51def9fa340050ec8fdb1
Instruction Fuzzy Hash: 9501D673610211ABEB6466B49C8BBBF7E5CB714750F254D21FC03F22D1D5A15C449294

Function 00521204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 00521276
WSAGetLastError.WSOCK32 ref: 00521283
bind.WSOCK32(00000000,?,00000010), ref: 005212BA
WSAGetLastError.WSOCK32 ref: 005212C5
closesocket.WSOCK32(00000000), ref: 005212F4
listen.WSOCK32(00000000,00000005), ref: 00521303
WSAGetLastError.WSOCK32 ref: 0052130D
closesocket.WSOCK32(00000000), ref: 0052133C

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: da3c12af73bbf13d87c4022f83a93722132edebe0af06d2553f53372b63b3fea
Instruction ID: d848ffab4310d5088015cac49d13f610ba70b4472d8904fab4d5f4ce64f6e56b
Opcode Fuzzy Hash: da3c12af73bbf13d87c4022f83a93722132edebe0af06d2553f53372b63b3fea
Instruction Fuzzy Hash: AB418D35A00510AFD710DF25D488B2ABBE6BF66318F188488E8569F3D2C771ED85CBE0

Function 0050D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,004A3A97,?,?,004A2E7F,?,?,?,00000000), ref: 004A3AC2

Part of subcall function 0050E199: GetFileAttributesW.KERNEL32(?,0050CF95), ref: 0050E19A

FindFirstFileW.KERNEL32(?,?), ref: 0050D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0050D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0050D481
FindClose.KERNEL32(00000000), ref: 0050D498
FindClose.KERNEL32(00000000), ref: 0050D4A1

Strings

\*.*, xrefs: 0050D3F2

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: e77b3cf7f468519a35348ef8812becb7da2398293d90a567119ebfd872346baf
Instruction ID: b4a4223ccaf4ea58203825c484c0844e817420e42749576c89b964cd20a5c1f5
Opcode Fuzzy Hash: e77b3cf7f468519a35348ef8812becb7da2398293d90a567119ebfd872346baf
Instruction Fuzzy Hash: 7C3170710083419BC700EF65D8518AFBBA8BFA6344F444E1EF4D153191EB78AA0DD767

Function 004DE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004DE645

Strings

1#SNAN, xrefs: 004DF844
1#IND, xrefs: 004DF83D
1#QNAN, xrefs: 004DF84B
1#INF, xrefs: 004DF852

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c49cb63f869c752b3098f1836461e243be96fb2904df67ead1f106f69cf1a899
Instruction ID: cdc132c755d49c1306998caf7065d1c2d2f70f6d2cfc2a01a624daef1b612d6d
Opcode Fuzzy Hash: c49cb63f869c752b3098f1836461e243be96fb2904df67ead1f106f69cf1a899
Instruction Fuzzy Hash: 31C26771E086288BDB35DE299D507EAB7B5EB49304F1441EBD80EE7340E778AE858F44

Function 0051648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 005164DC
CoInitialize.OLE32(00000000), ref: 00516639
CoCreateInstance.OLE32(0053FCF8,00000000,00000001,0053FB68,?), ref: 00516650
CoUninitialize.OLE32 ref: 005168D4

Strings

.lnk, xrefs: 005164BA, 00516524, 005165E0

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 06b10d2af6657a15ce49ba715293889db8e1fccd44dfaca004979935b4e6f5e6
Instruction ID: 2f1f7a9514666614156062f1645bb922239da8cdb9ff744ac5d58ece080bf01b
Opcode Fuzzy Hash: 06b10d2af6657a15ce49ba715293889db8e1fccd44dfaca004979935b4e6f5e6
Instruction Fuzzy Hash: F4D15A71508201AFD314EF25C881DABBBE9FFA5308F40496DF5958B291EB30ED45CB92

Function 005222DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 005222E8

Part of subcall function 0051E4EC: GetWindowRect.USER32(?,?), ref: 0051E504

GetDesktopWindow.USER32 ref: 00522312
GetWindowRect.USER32(00000000), ref: 00522319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00522355
GetCursorPos.USER32(?), ref: 00522381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 005223DF

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 5961b23713c4119df1a084cc88ecc7e2fbf214febc1ce0448a1487132d0486c5
Instruction ID: bd757eab169b5dac153a992fdd3995a1f25abee6c76e9335770a894d0328ef20
Opcode Fuzzy Hash: 5961b23713c4119df1a084cc88ecc7e2fbf214febc1ce0448a1487132d0486c5
Instruction Fuzzy Hash: 6031DE76504315AFDB20DF14D849B9BBBA9FF99310F000A19F985A7291DB34EA08CB92

Function 00519B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00519B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00519C8B

Part of subcall function 00513874: GetInputState.USER32 ref: 005138CB
Part of subcall function 00513874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00513966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00519BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00519C75

Strings

*.*, xrefs: 00519B5D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 59f444fc34d8eeb22e7c3e9749b98f18e69a6dcf3d000be2befdcd848bcc663f
Instruction ID: a6d06a0e53d53b5bcdc91f72ac29c8d1a6c1f480621488fee5b7f410721bfeb9
Opcode Fuzzy Hash: 59f444fc34d8eeb22e7c3e9749b98f18e69a6dcf3d000be2befdcd848bcc663f
Instruction Fuzzy Hash: 62417F7190420A9FDF14DF64C895AEEBFB8FF15314F10405AE845A2291EB349E94CFA5

Function 004B997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 004B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 004B9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 004B9A4E
GetSysColor.USER32(0000000F), ref: 004B9B23
SetBkColor.GDI32(?,00000000), ref: 004B9B36

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 018a0f9dd5ef9714c8c2b3a68f5460c26888f8210a05cd7e57d2363abc251b67
Instruction ID: d91b5736ca41ace9b8a38b737764e4bd77b145268dcd6cab7760bff43a74b843
Opcode Fuzzy Hash: 018a0f9dd5ef9714c8c2b3a68f5460c26888f8210a05cd7e57d2363abc251b67
Instruction Fuzzy Hash: 3FA11B70118448BEE724AA3D9C59DFB3A9DEB86350F14410BF302C6791CA6D9D42E27F

Function 00521806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0052304E: inet_addr.WSOCK32(?), ref: 0052307A
Part of subcall function 0052304E: _wcslen.LIBCMT ref: 0052309B

socket.WSOCK32(00000002,00000002,00000011), ref: 0052185D
WSAGetLastError.WSOCK32 ref: 00521884
bind.WSOCK32(00000000,?,00000010), ref: 005218DB
WSAGetLastError.WSOCK32 ref: 005218E6
closesocket.WSOCK32(00000000), ref: 00521915

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 72a3d62d0b9bbd9ba343578e6b8ae0242e0792af04dbdfac0412042106de832f
Instruction ID: 55186609e13b0e60076ab04f247167d5b31260d007f3b5afaca61a351ab5c765
Opcode Fuzzy Hash: 72a3d62d0b9bbd9ba343578e6b8ae0242e0792af04dbdfac0412042106de832f
Instruction Fuzzy Hash: 5B51D371A00210AFDB10AF24D8C6F6A7BE5AF56718F08849DF9066F3C3C775AD418BA5

Function 00531C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00531CC0
IsWindowEnabled.USER32 ref: 00531CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00531CDB
IsIconic.USER32 ref: 00531CE9
IsZoomed.USER32 ref: 00531CF7

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: ca68b03d7a622b65a3574a9c17a4b7b107a5a3e7d827fd92189b64cfd7545c1a
Instruction ID: c9771c53c8831e0ec17bbe10801efa030e1d6e3575600895881b8ec10e7aeda7
Opcode Fuzzy Hash: ca68b03d7a622b65a3574a9c17a4b7b107a5a3e7d827fd92189b64cfd7545c1a
Instruction Fuzzy Hash: 5221BF31740A059FD7208F2AC894B6A7FA5FF95315F189068E84A9B351CB71EC42CB98

Function 004A8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 004A843C
VUUU, xrefs: 004E5DF0
ERCP, xrefs: 004A813C
VUUU, xrefs: 004A83E8
VUUU, xrefs: 004A83FA

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 6411e73b255ce6c73244056ec204adb5d3923dd98f14487e723fce295f1d49c3
Instruction ID: 2817c5ce2aee7639e5b1e4e6fb773cf12f192f5d4764ec411525b83ea75eea5d
Opcode Fuzzy Hash: 6411e73b255ce6c73244056ec204adb5d3923dd98f14487e723fce295f1d49c3
Instruction Fuzzy Hash: C2A29C70E0025ACBDF24CF59C8407AEB7B1FB65315F2581ABD815A7381EB389D81CB99

Function 00508298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 005082AA

Strings

|, xrefs: 005082DA
tbV, xrefs: 005084F4
(, xrefs: 005082F0

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($tbV$|
API String ID: 1659193697-2685671569
Opcode ID: 463d481a0454f680fb0c53c63a5a33f8191d8ea70b6a99c9e54fd703da3f61a6
Instruction ID: 8534dc0c33d3a34c8ee8762fd4a5c2bce8912e42e3f8bf9df5e8aeceaa320855
Opcode Fuzzy Hash: 463d481a0454f680fb0c53c63a5a33f8191d8ea70b6a99c9e54fd703da3f61a6
Instruction Fuzzy Hash: 3B322774A006059FCB28CF19C481EAABBF0FF48710B15C96EE59ADB3A1DB70E941CB44

Function 0052A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0052A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0052A6BA

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0052A79C
CloseHandle.KERNEL32(00000000), ref: 0052A7AB

Part of subcall function 004BCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,004E3303,?), ref: 004BCE8A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 600e01872b1a9012302520ee25067dae684ec8d0e6b9c5c10b5d28cbd95070f3
Instruction ID: dfe1933f9c9d653597d00918e19aeb3720d73a46dd31cc78c327e17eed343ac5
Opcode Fuzzy Hash: 600e01872b1a9012302520ee25067dae684ec8d0e6b9c5c10b5d28cbd95070f3
Instruction Fuzzy Hash: F051B0715083109FD310EF25C886E6BBBE8FF9A748F00491EF58597291EB34E904CBA6

Function 0050AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0050AAAC
SetKeyboardState.USER32(00000080), ref: 0050AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0050AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0050AB88

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: cae79d19c3bee768cddbcf9ba9aaf4178a563a04f0dcb8bb622f70da448db790
Instruction ID: 89c4bde00f29211ea6cc2aabe4ee1c47ab58a0107e4f8451e6a1096b1372c5db
Opcode Fuzzy Hash: cae79d19c3bee768cddbcf9ba9aaf4178a563a04f0dcb8bb622f70da448db790
Instruction Fuzzy Hash: 29311431A40348AEFF358B68CC09BFE7FAABB84310F08421AF081961D1D774C985D762

Function 004DBB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004DBB7F

Part of subcall function 004D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,004DD7D1,00000000,00000000,00000000,00000000,?,004DD7F8,00000000,00000007,00000000,?,004DDBF5,00000000), ref: 004D29DE
Part of subcall function 004D29C8: GetLastError.KERNEL32(00000000,?,004DD7D1,00000000,00000000,00000000,00000000,?,004DD7F8,00000000,00000007,00000000,?,004DDBF5,00000000,00000000), ref: 004D29F0

GetTimeZoneInformation.KERNEL32 ref: 004DBB91
WideCharToMultiByte.KERNEL32(00000000,?,0057121C,000000FF,?,0000003F,?,?), ref: 004DBC09
WideCharToMultiByte.KERNEL32(00000000,?,00571270,000000FF,?,0000003F,?,?,?,0057121C,000000FF,?,0000003F,?,?), ref: 004DBC36

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 9fa5ce953ed9029af32e5889da05320f21c60245e92e60502d910e9ca141aa70
Instruction ID: 28d4d938775b1297e41507a6ce102a6150827b25956f9b3856d7c90f2eb50f07
Opcode Fuzzy Hash: 9fa5ce953ed9029af32e5889da05320f21c60245e92e60502d910e9ca141aa70
Instruction Fuzzy Hash: 6331DE70904205DFCB10DF6A9C9182EBBB8FF5571071582AFE014EB3A2D7349944EB98

Function 0051CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0051CE89
GetLastError.KERNEL32(?,00000000), ref: 0051CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0051CEFE

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: da109754a9ead650cb507976a0f3269f12b560fb92bee5ae61474f61279e0fc1
Instruction ID: 4dbc9a56528fbe51a9f3bcd613d6670732a999feae484b783ef941aa1c963ebb
Opcode Fuzzy Hash: da109754a9ead650cb507976a0f3269f12b560fb92bee5ae61474f61279e0fc1
Instruction Fuzzy Hash: 2321ED71540305ABEB20DFA5C948BA7BFFCFB10308F10491EE542A2251E735EE898B94

Function 00515C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00515CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00515D17
FindClose.KERNEL32(?), ref: 00515D5F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: c44bb4568cd5337728b7b661960110bcc54cbcc9fae619f4f79bf8fdcfe80ca4
Instruction ID: b37cbb36d9c51bb47bfe0d19b6e3301aeb632543fec9c0662ebf0c86e7ebe0ad
Opcode Fuzzy Hash: c44bb4568cd5337728b7b661960110bcc54cbcc9fae619f4f79bf8fdcfe80ca4
Instruction Fuzzy Hash: 12519974604601DFD714CF28D484E9ABBE4FF8A318F14855EE99A8B3A1DB30ED84CB91

Function 004D2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004D271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004D2724
UnhandledExceptionFilter.KERNEL32(?), ref: 004D2731

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 919f71bff13a998dba15f8905de480b2515cf90fcbaa09f32cba81747506e1f8
Instruction ID: 5f71f5e34660db696bc24329952efa35b5148cd8c4fa803fe7704bc08e05ec42
Opcode Fuzzy Hash: 919f71bff13a998dba15f8905de480b2515cf90fcbaa09f32cba81747506e1f8
Instruction Fuzzy Hash: 1931D77590121CABCB61DF65DD88B9DBBB8AF18310F5041DAE81CA7260E7749F858F44

Function 005151CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005151DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00515238
SetErrorMode.KERNEL32(00000000), ref: 005152A1

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: bc6c47e7460973885c9abd85024b03ec729932e0a681c891031e669fe0c1f9ac
Instruction ID: e5b9b63d826aef8f29a414a7cf7af2aa40d5f4641c6aaba6dade43356c606b99
Opcode Fuzzy Hash: bc6c47e7460973885c9abd85024b03ec729932e0a681c891031e669fe0c1f9ac
Instruction Fuzzy Hash: 0B313E75A00618DFDB00DF55D884EADBBB4FF59318F448099E805AB3A2DB35E859CB90

Function 005016C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 004BFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 004C0668
Part of subcall function 004BFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 004C0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0050170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0050173A
GetLastError.KERNEL32 ref: 0050174A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 1a7d9a2d4f91c884cae4c2a980c1802ac7bf01c5cc67333f9b5ab30ba6fbdce7
Instruction ID: abfe1b3a0ada58ef57129eb14856480f0946b4939308ba4dbb0c43b413242428
Opcode Fuzzy Hash: 1a7d9a2d4f91c884cae4c2a980c1802ac7bf01c5cc67333f9b5ab30ba6fbdce7
Instruction Fuzzy Hash: 47119EB2504704AFD718AF54DC86DAEBBBDFB44754B20852EE05657281EB70FC458B24

Function 0050D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0050D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0050D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0050D650

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 0dc02479fa967e961b0a0b6fe64ba5ce48fb94a96edcf6858857cc111086ad70
Instruction ID: 6be9b52cdb727b6a026a37596be846937adc4520c109e04d8ebe5f76e2687f24
Opcode Fuzzy Hash: 0dc02479fa967e961b0a0b6fe64ba5ce48fb94a96edcf6858857cc111086ad70
Instruction Fuzzy Hash: 73117C75E01228BBDB108F949C44FAFBFBCEB45B50F108111F904E7290C2704A059BA1

Function 00501663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 005016A1
FreeSid.ADVAPI32(?), ref: 005016B1

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 8d396450ce08f07dd52392a91b37aaff9a1f47553d3075a01aad7fecf38f8bdb
Instruction ID: 9ed7fb4151037154a0b34a1b796f4bf700871f0bd0aeea5172afe6a55d87f3ae
Opcode Fuzzy Hash: 8d396450ce08f07dd52392a91b37aaff9a1f47553d3075a01aad7fecf38f8bdb
Instruction Fuzzy Hash: C2F0F47195030DFBDB00DFE49D89AAEBBBCFB08704F504565E501E2281E774AA489B54

Function 004C4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(004D28E9,?,004C4CBE,004D28E9,005688B8,0000000C,004C4E15,004D28E9,00000002,00000000,?,004D28E9), ref: 004C4D09
TerminateProcess.KERNEL32(00000000,?,004C4CBE,004D28E9,005688B8,0000000C,004C4E15,004D28E9,00000002,00000000,?,004D28E9), ref: 004C4D10
ExitProcess.KERNEL32 ref: 004C4D22

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8ecf1b22b5ccf821d0318d2adddbd69bf33cdf3ec1e4cce1ba2a9446ba1daacb
Instruction ID: a6818c641dd7cb799aadae6e8d994d15e70c6f69a620edea9be4dee0dd738047
Opcode Fuzzy Hash: 8ecf1b22b5ccf821d0318d2adddbd69bf33cdf3ec1e4cce1ba2a9446ba1daacb
Instruction Fuzzy Hash: E2E04635000108ABCF61BF20DE1AF893F29EB91795B004419FC069B322CB39DD42EB84

Function 004FD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 004FD28C

Strings

X64, xrefs: 004FD2A8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 1f8d784313d69e5045403ef42096dd439417c2a75496777282b789fbf42783b3
Instruction ID: 0cd327201331b3caaa128eaa38ce9b1a8718b7ad65b8a7d4385c541b89586f08
Opcode Fuzzy Hash: 1f8d784313d69e5045403ef42096dd439417c2a75496777282b789fbf42783b3
Instruction Fuzzy Hash: CBD0C9B480111DEACB94DB90DC8CDDDB77CBB14305F100192F106E2100D73495499F21

Function 004CCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 0f6b3457ec738b1654c6b769f0af7a90a4acb776bc9a8fd75c6ab8763fc243b0
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 70023B75E002199BDF54CFA9C980BAEBBF1EF49314F25816ED819E7380D735AE418B84

Function 004ACAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

p#W, xrefs: 004ACF7F
Variable is not of type 'Object'., xrefs: 004F0C40

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#W
API String ID: 0-2765910906
Opcode ID: 1d8a4e1818a430a23c482b90be97ae378d27176b1aa9a989174d18c7e2719478
Instruction ID: 459a324063ecda1f1c379fbe92a7169e6c27918e48f2be9c4a14128d90452134
Opcode Fuzzy Hash: 1d8a4e1818a430a23c482b90be97ae378d27176b1aa9a989174d18c7e2719478
Instruction Fuzzy Hash: 52327A70900218DFDF14DF90C984AFEB7B5BF66308F14405AE906AB382D739AD46CB69

Function 005168EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00516918
FindClose.KERNEL32(00000000), ref: 00516961

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 28764e77498c21e0444403f70b1008c461aa25b671568bc2b5dc75a290384eea
Instruction ID: b6d0960201642d0e68b297940740aadf9ee4d5979641b5eef126cdbe86ec2a29
Opcode Fuzzy Hash: 28764e77498c21e0444403f70b1008c461aa25b671568bc2b5dc75a290384eea
Instruction Fuzzy Hash: A6117C356042109FD710DF2AD884A16BBE5FF85328F14C69EF8698B6A2C734EC45CB91

Function 005137B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00524891,?,?,00000035,?), ref: 005137E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00524891,?,?,00000035,?), ref: 005137F4

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: d2590384f33ccb9c84b0f19ccbcd89b3720432e06c7a57806a8a823e23903dfc
Instruction ID: 45db2f7295798ae2df590e919f1072f92c88585f7848f7d1cfcc649c1dd50980
Opcode Fuzzy Hash: d2590384f33ccb9c84b0f19ccbcd89b3720432e06c7a57806a8a823e23903dfc
Instruction Fuzzy Hash: AAF0EC716043142AE71057664C4DFDB3E5DEFC5765F000575F509E22D1D9609D48C7B0

Function 0050B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0050B25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 0050B270

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 3007cc89c21c96612a080841df259811ce50949ae3222dd9b4747409e024e4e1
Instruction ID: 599f846481cc4be24e857103a0589defafb873470de58bc2779e2eb617904c32
Opcode Fuzzy Hash: 3007cc89c21c96612a080841df259811ce50949ae3222dd9b4747409e024e4e1
Instruction Fuzzy Hash: 44F01D7580424EABEB059FA0C805BAE7FB4FF14305F008409F955A5191C37986159F94

Function 005010BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005011FC), ref: 005010D4
CloseHandle.KERNEL32(?,?,005011FC), ref: 005010E9

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: f766878921e10f32d0e2559258d396865f77e7ad50a330db75249d44d22a7f69
Instruction ID: 822254bc999f679b31cbb8b3fbde040b5c774323980ba63ae5b18585daa4d17e
Opcode Fuzzy Hash: f766878921e10f32d0e2559258d396865f77e7ad50a330db75249d44d22a7f69
Instruction Fuzzy Hash: 04E0BF72014610AFE7252B51FC09EB77BE9EB04314B14882EF5A6905B1DB62ACA4EB64

Function 004ABF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#W, xrefs: 004F07CE

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#W
API String ID: 3964851224-3759538804
Opcode ID: a411d2a6dc3f0d1897b492ee5a6f0dd035c2fc0a4ac2cedbde5c78894c933991
Instruction ID: 43fb46618f4edbe08fab0eb3bdbee3cefbe2fe302ae40b9580a94f2f521e56be
Opcode Fuzzy Hash: a411d2a6dc3f0d1897b492ee5a6f0dd035c2fc0a4ac2cedbde5c78894c933991
Instruction Fuzzy Hash: 85A26C70A083019FD750DF14C480B6BBBE1BF9A304F14896EE99A8B352D779EC45CB96

Function 004D676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004D6766,?,?,00000008,?,?,004DFEFE,00000000), ref: 004D6998

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 664dc38948e42dd1cf2f16e9cb65e04d0e37bf727c8a3e0d1911d6cd5b75415e
Instruction ID: d852bbef5695602df3ffee58f933a11d8a4d54cdf03a9f892ca8c3181c6e8adc
Opcode Fuzzy Hash: 664dc38948e42dd1cf2f16e9cb65e04d0e37bf727c8a3e0d1911d6cd5b75415e
Instruction Fuzzy Hash: 97B16D716106089FD714CF28C4A6B657BE0FF05364F26869AE8D9CF3A1C339D982CB44

Function 004BB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 004F851F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e576d6a7398f3fe0871404b7840f7ae5e02a2e74d19610b5092ddbee21a826a7
Instruction ID: d6fae5a93a168a83799665ab2d55ec5063b10c8cd42b686341b2ed0fd2d3c7c9
Opcode Fuzzy Hash: e576d6a7398f3fe0871404b7840f7ae5e02a2e74d19610b5092ddbee21a826a7
Instruction Fuzzy Hash: 881250719002299BDB14CF58C8806FEB7F5FF48710F14819AE949EB251EB749E81CFA5

Function 0051EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0051EABD

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 26f7a71e928d0afd3a0575c383ccd07714998652118c7c5e4936ea839b9537ba
Instruction ID: 6ceb894c89597592fed61042e1c9570b97bff656ffa23bcad3001a54e3673540
Opcode Fuzzy Hash: 26f7a71e928d0afd3a0575c383ccd07714998652118c7c5e4936ea839b9537ba
Instruction Fuzzy Hash: 0CE012312002049FD710DF5AD445D9ABBD9BF69764F00841AFC45D7351D674A8408B91

Function 004C09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,004C03EE), ref: 004C09DA

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 161d99b96832c4661a2902e7758a2d1cbc4f46fbf39c4c42a56e12de4479ed7a
Instruction ID: 1546f55995e969c3fa3c6851baf002323866d3f730423a74aa9e4f0852b44a59
Opcode Fuzzy Hash: 161d99b96832c4661a2902e7758a2d1cbc4f46fbf39c4c42a56e12de4479ed7a
Instruction Fuzzy Hash:

Function 004C781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 004C798B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: e3d6939d9b3b9767a182e95562f4611ec756e338f48bd41e16d2ee9c47a87be3
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: F5517EAD60C60557EBF4662A4459FBF27959B12344F18050FDA82C7382C62DDE02DF7E

Function 00512046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&W, xrefs: 00512053

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID: 0&W
API String ID: 0-3992681457
Opcode ID: af80b4b9f378895bd21e2bd93cf6f7df0e7a15d17078d4a7d7c17ebaf647048e
Instruction ID: c437a13a568acefba01f0ee8e1a7847479dc3f12103a5a5223a36a76fd737bde
Opcode Fuzzy Hash: af80b4b9f378895bd21e2bd93cf6f7df0e7a15d17078d4a7d7c17ebaf647048e
Instruction Fuzzy Hash: EE21D5322206118BD728CF79C8276BA77E5B764310F14862EE4A7C33D1DE39A944DB80

Function 004D6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e1f9140c9d3d65d9c8893c9fda3506940c1e307d3503493e85017a2fedd5d9
Instruction ID: 74ffd857413f4321bf1d36a36593dce5ef1b65df07a81d940ab391b940514b53
Opcode Fuzzy Hash: f4e1f9140c9d3d65d9c8893c9fda3506940c1e307d3503493e85017a2fedd5d9
Instruction Fuzzy Hash: 57322226D29F114DD7239634D832336A249AFB73C9F55C737F81AB5EAAEB28C4835101

Function 004BCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86dcc5b858809cf2c586eab4df4f705001fbb93cf49afe545a38dcdad73ce92b
Instruction ID: 25016c22b3c1a3cbb8344f99e124f06dc827120f1785d476888a588567d10718
Opcode Fuzzy Hash: 86dcc5b858809cf2c586eab4df4f705001fbb93cf49afe545a38dcdad73ce92b
Instruction Fuzzy Hash: 1A32F631A0414D8BDF28CA29C6D46BF7BB1EB45300F28856BD659CB391D23CDD82DB99

Function 004A7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e175ff5125d39fdadc3fca7cd6fa83e36fed134d84488a704c687c24d2a8b457
Instruction ID: 8992fecb0e192a75d1016f1f59f47273b39c618a978cbc943012500794ab9113
Opcode Fuzzy Hash: e175ff5125d39fdadc3fca7cd6fa83e36fed134d84488a704c687c24d2a8b457
Instruction Fuzzy Hash: 3622D1B0A00609EFDF14CF65C841AAEB3B5FF55308F10452AE816A7391E739ED15CB69

Function 004A91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2233f29c134f69c5bae5bf7656a0dcc63f7ff41ffe0412aae38b2dc6a64f6d
Instruction ID: 8b9714f7b7f9a356966f5f39d87041d0ccdad5b90c5fa68ef3ee1815e0dd5cad
Opcode Fuzzy Hash: dd2233f29c134f69c5bae5bf7656a0dcc63f7ff41ffe0412aae38b2dc6a64f6d
Instruction Fuzzy Hash: D602D7B1E00105EFCB04DF66D881AAEB7B5FF54304F10856AE8069B391E739EE15CB99

Function 004D9EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d27f53259606f06a9182577ffd60705f9f22c8ee139fb7f46ccef6e4e05f5da
Instruction ID: 021b0a018950f6cbe2dc6d97945924a6e10126fc0a1bdfee3a871c8d59d1d546
Opcode Fuzzy Hash: 1d27f53259606f06a9182577ffd60705f9f22c8ee139fb7f46ccef6e4e05f5da
Instruction Fuzzy Hash: 13B10424D2AF404DD3239B398835336B65CAFBB6D9F51D71BFC1674E22EB2286879140

Function 004C1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 5ae4e298faa7a51da84f9ada5f2daf5f6da7ee8984155c43d541b5dee148bd5d
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 5A91BA7A1080A349D7A9423D8434A3FFFE15A533A1319079FE4F3CA2E2FE28D565D624

Function 004C1F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 4950f7c309ee9d0877865156c6ae5c21ee9ab3d917eaab9432c60b8ffdea8692
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 2D91CC762080A349D7A9423E853493FFFE15A933A130E079FD4F2CB2D2EEA8C554D624

Function 004C19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 6d86691e3be10487ea07ff2f31d6fa3e6d0151a1ba52e4fff087744dac336b90
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 3891DB7A2090E309DB9D4279847493FFFE14A933A1319079FD4F2CA2E2FD28D965D624

Function 004C7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa833f34d40d8c120fe9f7b5d0e85958607de0cb64e272b99499ef34e2647297
Instruction ID: 78195b7a578e528b980c8eaba446c57ae51459f9eef499fc0dff9e406b3ecc91
Opcode Fuzzy Hash: aa833f34d40d8c120fe9f7b5d0e85958607de0cb64e272b99499ef34e2647297
Instruction Fuzzy Hash: D761247D20870567DBF49A288995FBF3394DB41718F14091FE942DB382E61EAE428F1E

Function 004C7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe631b7e0f07c919e5a89479cc61a72c1b9d5943cd1bccb771277419c304ac99
Instruction ID: fcbd3f9de3365685df68d2d0234dd65bf4d4c5dcc07767ccd908b3755671a569
Opcode Fuzzy Hash: fe631b7e0f07c919e5a89479cc61a72c1b9d5943cd1bccb771277419c304ac99
Instruction Fuzzy Hash: 17617B7E20870967DAF84A285892FBF2394AF41744F10495FF943CB381DA1EAD42CE5E

Function 004C1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 0fbb1e849c7f5d8d96e52fac2450b53df482d59758bfb76ed37f1298939c7cc5
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: C481987A50D0A309DB9D4239857493FFFE15A933A131A079FD4F2CA2E3ED28C554D624

Function 00522ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00522B30
DeleteObject.GDI32(00000000), ref: 00522B43
DestroyWindow.USER32 ref: 00522B52
GetDesktopWindow.USER32 ref: 00522B6D
GetWindowRect.USER32(00000000), ref: 00522B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00522CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00522CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00522CF8
GetClientRect.USER32(00000000,?), ref: 00522D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00522D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00522D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00522D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00522D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00522D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00522D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00522DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00522DA8
GlobalFree.KERNEL32(00000000), ref: 00522DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00522DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0053FC38,00000000), ref: 00522DDB
GlobalFree.KERNEL32(00000000), ref: 00522DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00522E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00522E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00522E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0052303F

Strings

DISPLAY, xrefs: 00522EA2
static, xrefs: 00522D3A, 00522E91
, xrefs: 00522FC5
AutoIt v3, xrefs: 00522CF2

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8f24f629e9f6a66c0f3bb2b0689c66fbc988989cc235741da69a245e4537f77c
Instruction ID: 5249657f1f41f16ddd515ee2408fc389d9f34fe4a4ca81847d43dc5c00b8ae34
Opcode Fuzzy Hash: 8f24f629e9f6a66c0f3bb2b0689c66fbc988989cc235741da69a245e4537f77c
Instruction Fuzzy Hash: 45029A75900214AFDB14DFA8DC89EAE7FB9FF59314F048518F915AB2A1CB34AD04DB60

Function 005370D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0053712F
GetSysColorBrush.USER32(0000000F), ref: 00537160
GetSysColor.USER32(0000000F), ref: 0053716C
SetBkColor.GDI32(?,000000FF), ref: 00537186
SelectObject.GDI32(?,?), ref: 00537195
InflateRect.USER32(?,000000FF,000000FF), ref: 005371C0
GetSysColor.USER32(00000010), ref: 005371C8
CreateSolidBrush.GDI32(00000000), ref: 005371CF
FrameRect.USER32(?,?,00000000), ref: 005371DE
DeleteObject.GDI32(00000000), ref: 005371E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00537230
FillRect.USER32(?,?,?), ref: 00537262
GetWindowLongW.USER32(?,000000F0), ref: 00537284

Part of subcall function 005373E8: GetSysColor.USER32(00000012), ref: 00537421
Part of subcall function 005373E8: SetTextColor.GDI32(?,?), ref: 00537425
Part of subcall function 005373E8: GetSysColorBrush.USER32(0000000F), ref: 0053743B
Part of subcall function 005373E8: GetSysColor.USER32(0000000F), ref: 00537446
Part of subcall function 005373E8: GetSysColor.USER32(00000011), ref: 00537463
Part of subcall function 005373E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00537471
Part of subcall function 005373E8: SelectObject.GDI32(?,00000000), ref: 00537482
Part of subcall function 005373E8: SetBkColor.GDI32(?,00000000), ref: 0053748B
Part of subcall function 005373E8: SelectObject.GDI32(?,?), ref: 00537498
Part of subcall function 005373E8: InflateRect.USER32(?,000000FF,000000FF), ref: 005374B7
Part of subcall function 005373E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 005374CE
Part of subcall function 005373E8: GetWindowLongW.USER32(00000000,000000F0), ref: 005374DB

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 51fcc5c4901b8bbad2d38a0a7e8d69840d7cc1ae8c4d434d51b8e0c7f39b5d69
Instruction ID: dd878f62cda56a43ade082326a198b6e51f73a8f7fc5b19f971303ae1366e633
Opcode Fuzzy Hash: 51fcc5c4901b8bbad2d38a0a7e8d69840d7cc1ae8c4d434d51b8e0c7f39b5d69
Instruction Fuzzy Hash: DBA1B072408305AFDB109F64DC48E6B7FA9FF9C321F100A19F962A62E1D771E948EB51

Function 004B8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 004B8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 004F6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 004F6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004F6F43

Part of subcall function 004B8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,004B8BE8,?,00000000,?,?,?,?,004B8BBA,00000000,?), ref: 004B8FC5

SendMessageW.USER32(?,00001053), ref: 004F6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 004F6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 004F6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 004F6FB7

Strings

0, xrefs: 004F6DCF

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 72a3399895cec08877da8046dbf89ed201943b244517bcc0e30ee172b11beebf
Instruction ID: 745975ebf5d0a1c33d07c4bb5cadaaad73339660b0dd4365649610b591dfad91
Opcode Fuzzy Hash: 72a3399895cec08877da8046dbf89ed201943b244517bcc0e30ee172b11beebf
Instruction Fuzzy Hash: BB12DE30200205DFDB25DF18D844BBABBE5FB54300F15406EE689CB261CB39EC96EB69

Function 00522711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0052273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0052286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 005228A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 005228B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00522900
GetClientRect.USER32(00000000,?), ref: 0052290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00522955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00522964
GetStockObject.GDI32(00000011), ref: 00522974
SelectObject.GDI32(00000000,00000000), ref: 00522978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00522988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00522991
DeleteDC.GDI32(00000000), ref: 0052299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 005229C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 005229DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00522A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00522A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00522A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00522A77
GetStockObject.GDI32(00000011), ref: 00522A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00522A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00522A97

Strings

DISPLAY, xrefs: 0052295A
static, xrefs: 0052294F, 00522A71
msctls_progress32, xrefs: 00522A13
AutoIt v3, xrefs: 005228F8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 77faa6711ad153210878fa3e36355c7d3f65fdb9648e05ad563d29321df4b07e
Instruction ID: dcf77e92ede271818ccef2ccf7b8b505ae1e90235797529534c92d4295d27815
Opcode Fuzzy Hash: 77faa6711ad153210878fa3e36355c7d3f65fdb9648e05ad563d29321df4b07e
Instruction Fuzzy Hash: D2B18B75A00215BFEB10DFA8DC8AEAE7BA9FB19714F008519F914E7290C774ED40DBA4

Function 00514ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00514AED
GetDriveTypeW.KERNEL32(?,0053CB68,?,\\.\,0053CC08), ref: 00514BCA
SetErrorMode.KERNEL32(00000000,0053CB68,?,\\.\,0053CC08), ref: 00514D36

Strings

ATA, xrefs: 00514C98
iSCSI, xrefs: 00514CC2
\\.\, xrefs: 00514B3F
USB, xrefs: 00514CB4
Network, xrefs: 00514C02
SSA, xrefs: 00514CA6
SCSI, xrefs: 00514C8A
SATA, xrefs: 00514CD0
Fibre, xrefs: 00514CAD
SAS, xrefs: 00514CC9
CDROM, xrefs: 00514BFB
MMC, xrefs: 00514CDE
Fixed, xrefs: 00514C09
PhysicalDrive, xrefs: 00514B76
Removable, xrefs: 00514C10, 00514C15
Virtual, xrefs: 00514CE5
RAID, xrefs: 00514CBB
1394, xrefs: 00514C9F
SSD, xrefs: 00514C4A
FileBackedVirtual, xrefs: 00514CEC
RAMDisk, xrefs: 00514BF4
Unknown, xrefs: 00514BED, 00514C83
ATAPI, xrefs: 00514C91

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 53b7708c327294e3882a511c9eeef8345e9fc51b50655c9c6711869f5943f60c
Instruction ID: e902b35ef6085bbed35554e4808c65bc6719ffd4a27ac5d1d3aab3b37d994242
Opcode Fuzzy Hash: 53b7708c327294e3882a511c9eeef8345e9fc51b50655c9c6711869f5943f60c
Instruction Fuzzy Hash: F261D330705106EBEB04DF24CA81DECBFB1BB55748B24981AF806AB691DB39DD81DF81

Function 005373E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00537421
SetTextColor.GDI32(?,?), ref: 00537425
GetSysColorBrush.USER32(0000000F), ref: 0053743B
GetSysColor.USER32(0000000F), ref: 00537446
CreateSolidBrush.GDI32(?), ref: 0053744B
GetSysColor.USER32(00000011), ref: 00537463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00537471
SelectObject.GDI32(?,00000000), ref: 00537482
SetBkColor.GDI32(?,00000000), ref: 0053748B
SelectObject.GDI32(?,?), ref: 00537498
InflateRect.USER32(?,000000FF,000000FF), ref: 005374B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 005374CE
GetWindowLongW.USER32(00000000,000000F0), ref: 005374DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0053752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00537554
InflateRect.USER32(?,000000FD,000000FD), ref: 00537572
DrawFocusRect.USER32(?,?), ref: 0053757D
GetSysColor.USER32(00000011), ref: 0053758E
SetTextColor.GDI32(?,00000000), ref: 00537596
DrawTextW.USER32(?,005370F5,000000FF,?,00000000), ref: 005375A8
SelectObject.GDI32(?,?), ref: 005375BF
DeleteObject.GDI32(?), ref: 005375CA
SelectObject.GDI32(?,?), ref: 005375D0
DeleteObject.GDI32(?), ref: 005375D5
SetTextColor.GDI32(?,?), ref: 005375DB
SetBkColor.GDI32(?,?), ref: 005375E5

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: f0e7bf9fcf5f4027a68777b66610eeb37a8145c46beb3a7316f16fdbec829e02
Instruction ID: b169383f824b48c272e0f599a4d6653fac25964333cf632746c05930080c40ca
Opcode Fuzzy Hash: f0e7bf9fcf5f4027a68777b66610eeb37a8145c46beb3a7316f16fdbec829e02
Instruction Fuzzy Hash: 94616A72D00218AFDF119FA4DC49AEEBFB9FB08320F104115F915BB2A1D775A940EBA0

Function 00530FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00531128
GetDesktopWindow.USER32 ref: 0053113D
GetWindowRect.USER32(00000000), ref: 00531144
GetWindowLongW.USER32(?,000000F0), ref: 00531199
DestroyWindow.USER32(?), ref: 005311B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 005311ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0053120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0053121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00531232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00531245
IsWindowVisible.USER32(00000000), ref: 005312A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 005312BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 005312D0
GetWindowRect.USER32(00000000,?), ref: 005312E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0053130E
GetMonitorInfoW.USER32(00000000,?), ref: 00531328
CopyRect.USER32(?,?), ref: 0053133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 005313AA

Strings

(, xrefs: 0053131B
0, xrefs: 005310D3
tooltips_class32, xrefs: 005311E6

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 97396658040edea01c0a86af64b117a53e114bc2ae235c09496bc23841a470e2
Instruction ID: 724a01eaea2afcd2699cb16361c9271c5dea4521fdfd1a81f9ef4df281371a4c
Opcode Fuzzy Hash: 97396658040edea01c0a86af64b117a53e114bc2ae235c09496bc23841a470e2
Instruction Fuzzy Hash: 8BB19C71608741AFD704DF65C889B6ABFE4FF94344F00891DF999AB2A2CB31E844CB95

Function 004B8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004B8968
GetSystemMetrics.USER32(00000007), ref: 004B8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004B899B
GetSystemMetrics.USER32(00000008), ref: 004B89A3
GetSystemMetrics.USER32(00000004), ref: 004B89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 004B89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 004B89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 004B8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 004B8A3C
GetClientRect.USER32(00000000,000000FF), ref: 004B8A5A
GetStockObject.GDI32(00000011), ref: 004B8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 004B8A81

Part of subcall function 004B912D: GetCursorPos.USER32(?), ref: 004B9141
Part of subcall function 004B912D: ScreenToClient.USER32(00000000,?), ref: 004B915E
Part of subcall function 004B912D: GetAsyncKeyState.USER32(00000001), ref: 004B9183
Part of subcall function 004B912D: GetAsyncKeyState.USER32(00000002), ref: 004B919D

SetTimer.USER32(00000000,00000000,00000028,004B90FC), ref: 004B8AA8

Strings

AutoIt v3 GUI, xrefs: 004B8A20

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 9a0693a7c0b00c429c83cab76fa3cc30c6cefb03e9bb987c4083c85a0e1b9312
Instruction ID: cbd33743e1294167c0a1177b1846365cd7aa3733ef7384a79ad81ad54159e525
Opcode Fuzzy Hash: 9a0693a7c0b00c429c83cab76fa3cc30c6cefb03e9bb987c4083c85a0e1b9312
Instruction Fuzzy Hash: 0AB17D71A002099FDF14DF68DC45BEE3BB5FB58314F11412AFA15A7290DB38A841DB69

Function 00500D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005010F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00501114
Part of subcall function 005010F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00500B9B,?,?,?), ref: 00501120
Part of subcall function 005010F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00500B9B,?,?,?), ref: 0050112F
Part of subcall function 005010F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00500B9B,?,?,?), ref: 00501136
Part of subcall function 005010F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0050114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00500DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00500E29
GetLengthSid.ADVAPI32(?), ref: 00500E40
GetAce.ADVAPI32(?,00000000,?), ref: 00500E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00500E96
GetLengthSid.ADVAPI32(?), ref: 00500EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00500EB5
HeapAlloc.KERNEL32(00000000), ref: 00500EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00500EDD
CopySid.ADVAPI32(00000000), ref: 00500EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00500F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00500F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00500F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00500F6E
HeapFree.KERNEL32(00000000), ref: 00500F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00500F7E
HeapFree.KERNEL32(00000000), ref: 00500F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00500F8E
HeapFree.KERNEL32(00000000), ref: 00500F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00500FA1
HeapFree.KERNEL32(00000000), ref: 00500FA8

Part of subcall function 00501193: GetProcessHeap.KERNEL32(00000008,00500BB1,?,00000000,?,00500BB1,?), ref: 005011A1
Part of subcall function 00501193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00500BB1,?), ref: 005011A8
Part of subcall function 00501193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00500BB1,?), ref: 005011B7

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 0f696d51267f52744d424f46055d5c84aecd0d18bb2410a38bce1a69989b7c49
Instruction ID: 26db33245dffc7fd9dff152860cf82edc54c64e16085659871bd4a77d37b0c4e
Opcode Fuzzy Hash: 0f696d51267f52744d424f46055d5c84aecd0d18bb2410a38bce1a69989b7c49
Instruction Fuzzy Hash: 11716A7290020AABDF209FA4DC49FAEBFB8BF15301F144115FA59F62D1D7719A09EB60

Function 0052C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0052C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0053CC08,00000000,?,00000000,?,?), ref: 0052C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0052C5A4
_wcslen.LIBCMT ref: 0052C5F4
_wcslen.LIBCMT ref: 0052C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0052C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0052C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0052C84D
RegCloseKey.ADVAPI32(?), ref: 0052C881
RegCloseKey.ADVAPI32(00000000), ref: 0052C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0052C960

Strings

REG_MULTI_SZ, xrefs: 0052C6F5
REG_QWORD, xrefs: 0052C8C3
REG_SZ, xrefs: 0052C644
REG_EXPAND_SZ, xrefs: 0052C5CD
REG_BINARY, xrefs: 0052C913
REG_DWORD, xrefs: 0052C804

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 7e8a8b0384f9f23b845be86ee1365966c11106f99de84c30c2c18886b5fc5125
Instruction ID: 102bad20c93d9f42010e7913f0f2e081b4d100f4192b31a37d6c566281fb453e
Opcode Fuzzy Hash: 7e8a8b0384f9f23b845be86ee1365966c11106f99de84c30c2c18886b5fc5125
Instruction Fuzzy Hash: E7128A356042109FDB14EF15D881A2EBBE5FF8A358F04885DF84A9B3A2DB35EC41CB85

Function 0053091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 005309C6
_wcslen.LIBCMT ref: 00530A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00530A54
_wcslen.LIBCMT ref: 00530A8A
_wcslen.LIBCMT ref: 00530B06
_wcslen.LIBCMT ref: 00530B81

Part of subcall function 004BF9F2: _wcslen.LIBCMT ref: 004BF9FD

Part of subcall function 00502BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00502BFA

Strings

COLLAPSE, xrefs: 00530B01, 00530B1C
GETSELECTED, xrefs: 00530C4E
GETTOTALCOUNT, xrefs: 005309F2, 00530A17
GETITEMCOUNT, xrefs: 00530C1E
ISCHECKED, xrefs: 00530CE1
SELECT, xrefs: 00530D11
GETTEXT, xrefs: 00530C97
CHECK, xrefs: 00530A85, 00530AA0
UNCHECK, xrefs: 00530D3E
EXISTS, xrefs: 00530B7C, 00530B97
EXPAND, xrefs: 00530BF8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: ca9bf60866ca54c685a95009428ede3fc2d35c2791cf0ef8f8109d28d9fa88b0
Instruction ID: cb596a032d1ed6079f2f7e01fc1a74076a3ee6601be88dce19f9272c26bc8ce4
Opcode Fuzzy Hash: ca9bf60866ca54c685a95009428ede3fc2d35c2791cf0ef8f8109d28d9fa88b0
Instruction Fuzzy Hash: 4FE1BC312083019FC714EF25C4A092EBBE1BF99358F14895DF89A9B7A2DB35ED45CB81

Function 0052C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0052B6AE,?,?), ref: 0052C9B5
_wcslen.LIBCMT ref: 0052C9F1
_wcslen.LIBCMT ref: 0052CA68
_wcslen.LIBCMT ref: 0052CA9E
_wcslen.LIBCMT ref: 0052CAF9
_wcslen.LIBCMT ref: 0052CB2F
_wcslen.LIBCMT ref: 0052CB7F

Strings

HKEY_CURRENT_CONFIG, xrefs: 0052CB79, 0052CB7E
HKU, xrefs: 0052CBF0
HKEY_LOCAL_MACHINE, xrefs: 0052CA62, 0052CA67
HKCR, xrefs: 0052CB29, 0052CB2E
HKEY_CLASSES_ROOT, xrefs: 0052CAF3, 0052CAF8
HKLM, xrefs: 0052CA98, 0052CA9D
HKEY_USERS, xrefs: 0052CBDF
HKCC, xrefs: 0052CBAC
HKEY_CURRENT_USER, xrefs: 0052CBBD
HKCU, xrefs: 0052CBCE

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 6594269f5cadb3615606484a010c34c2047d337a7467c14ce5b628455c43fb1e
Instruction ID: 51db135594217cf182ea41d0560241290417646d725f55ceb43f4ba4435aa086
Opcode Fuzzy Hash: 6594269f5cadb3615606484a010c34c2047d337a7467c14ce5b628455c43fb1e
Instruction Fuzzy Hash: F071143260013A8BCB20DE3CED515BE3F91BF66798B540529F866A72C6E735CD4483A0

Function 0053833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0053835A
_wcslen.LIBCMT ref: 0053836E
_wcslen.LIBCMT ref: 00538391
_wcslen.LIBCMT ref: 005383B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 005383F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,0053361A,?), ref: 0053844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00538487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 005384CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00538501
FreeLibrary.KERNEL32(?), ref: 0053850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0053851D
DestroyIcon.USER32(?), ref: 0053852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00538549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00538555

Strings

.exe, xrefs: 00538388
.dll, xrefs: 005383AB
.icl, xrefs: 00538368

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 303a20ebc3be0b5881ef9c2c52bb478dab5dfddce4fa8bba774a2103f99fd0d7
Instruction ID: afd26e824f22a1830e4c25a8294615ab2cafd26a1980ba79ebc36334266b364b
Opcode Fuzzy Hash: 303a20ebc3be0b5881ef9c2c52bb478dab5dfddce4fa8bba774a2103f99fd0d7
Instruction Fuzzy Hash: E561E071500315BEEB18DF64CC41FBE7BA8BB58715F10460AF815E61D1DB74A984D7A0

Function 004A7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#requireadmin, xrefs: 004A77FF
#pragma compile, xrefs: 004A77D3
#comments-end, xrefs: 004A78D9
#OnAutoItStartRegister, xrefs: 004A7817
Unterminated group of comments, xrefs: 004E528C
", xrefs: 004E5153
#include, xrefs: 004A7847
#cs, xrefs: 004A7873, 004A78C5
#include-once, xrefs: 004A782F
', xrefs: 004E5169
#ce, xrefs: 004A78ED
Bad directive syntax error, xrefs: 004E519A
Cannot parse #include, xrefs: 004E5279
#comments-start, xrefs: 004A785F, 004A78B1
#notrayicon, xrefs: 004A77E7

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 0b77b3574249f8cc3711bb9ada4c8c41839fdf5e123a01b04828d121d91113f4
Instruction ID: 30af7281d1f85cf86d6d2affa2b4eac3ff468ec2710e26f7510a42200545ee94
Opcode Fuzzy Hash: 0b77b3574249f8cc3711bb9ada4c8c41839fdf5e123a01b04828d121d91113f4
Instruction Fuzzy Hash: DD81FB75A04205BBDB20AF61DC42FAF7B64BF25344F04402FF905AA292EB7CD911D7A9

Function 00513E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00513EF8
_wcslen.LIBCMT ref: 00513F03
_wcslen.LIBCMT ref: 00513F5A
_wcslen.LIBCMT ref: 00513F98
GetDriveTypeW.KERNEL32(?), ref: 00513FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0051401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00514059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00514087

Strings

closed, xrefs: 00513F08, 00513F2D, 00513F46, 00513F7E, 00513F97
type cdaudio alias cd wait, xrefs: 00514001
set cd door , xrefs: 00514028
open, xrefs: 00513F54, 00513F59
wait, xrefs: 00514044
open , xrefs: 00513FE5
close cd wait, xrefs: 00514072
close, xrefs: 00513EFE, 00513F18

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: a08adcc47fedd42190fb3158639ad12a2c688e4fa98cb82ddb78f07d346fd89e
Instruction ID: ee83fc7e9a57d68a51e7e57aea223f641c26dbacfd7c2eea762b956aa0158b95
Opcode Fuzzy Hash: a08adcc47fedd42190fb3158639ad12a2c688e4fa98cb82ddb78f07d346fd89e
Instruction Fuzzy Hash: BC71F4316042119FD710EF25C8908ABBBF4FFA9758F00492EF89597251EB35ED8ACB91

Function 00505A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00505A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00505A40
SetWindowTextW.USER32(?,?), ref: 00505A57
GetDlgItem.USER32(?,000003EA), ref: 00505A6C
SetWindowTextW.USER32(00000000,?), ref: 00505A72
GetDlgItem.USER32(?,000003E9), ref: 00505A82
SetWindowTextW.USER32(00000000,?), ref: 00505A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00505AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00505AC3
GetWindowRect.USER32(?,?), ref: 00505ACC
_wcslen.LIBCMT ref: 00505B33
SetWindowTextW.USER32(?,?), ref: 00505B6F
GetDesktopWindow.USER32 ref: 00505B75
GetWindowRect.USER32(00000000), ref: 00505B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00505BD3
GetClientRect.USER32(?,?), ref: 00505BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00505C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00505C2F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 8e0dd68f6e33a0e2170fe8e439f95f6ba85e04015ee470c9c073b3e1d5d5387d
Instruction ID: c06caa34b4d040b1ed287b17ba7ba8e890cd76c7075902817da225e2ca437bc1
Opcode Fuzzy Hash: 8e0dd68f6e33a0e2170fe8e439f95f6ba85e04015ee470c9c073b3e1d5d5387d
Instruction Fuzzy Hash: E1715D31900B09AFDB20DFA8CE46A6FBFF5FF48705F104918E542A26A0E775A944DF50

Function 0051FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0051FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0051FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0051FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0051FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0051FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0051FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0051FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0051FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0051FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0051FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0051FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0051FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0051FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0051FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0051FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0051FECC
GetCursorInfo.USER32(?), ref: 0051FEDC
GetLastError.KERNEL32 ref: 0051FF1E

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 18072b30a4e3c47cee6740931f390e1cc9aa80dbeec14feae54b55a9651441ae
Instruction ID: df916af5d6f4406cf4cc2e15d1915bd3f1e01ab44a811f1e5c8e9de09159d480
Opcode Fuzzy Hash: 18072b30a4e3c47cee6740931f390e1cc9aa80dbeec14feae54b55a9651441ae
Instruction Fuzzy Hash: EC4131B0D083196ADB109FBA8C8985EBFE8FF04754B54452AF119E7281DB78A941CF91

Function 005030F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0050318D
_wcslen.LIBCMT ref: 005031F8

Strings

TEXT, xrefs: 0050347C
CLASSNN, xrefs: 005031F3, 00503204
[V, xrefs: 0050339A
NAME, xrefs: 00503335, 00503346
REGEXPCLASS, xrefs: 00503255, 00503266
CLASS, xrefs: 00503188, 005031A5
INSTANCE, xrefs: 00503453

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[V
API String ID: 176396367-1647748031
Opcode ID: d5b140fa25ebacbd083fab9487ea69004aa0ebdcd9077948f1366488c5fcffe5
Instruction ID: dadd515dc310f1e60b1152b748fcf42fd434be81e45ac083890d4249ef530c20
Opcode Fuzzy Hash: d5b140fa25ebacbd083fab9487ea69004aa0ebdcd9077948f1366488c5fcffe5
Instruction Fuzzy Hash: F0E1E632A00516ABCF289F78C851BEEBFB8BF54714F54851EE456B7290EB30AE45C790

Function 004C00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 004C00C6

Part of subcall function 004C00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0057070C,00000FA0,4529D2B3,?,?,?,?,004E23B3,000000FF), ref: 004C011C
Part of subcall function 004C00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,004E23B3,000000FF), ref: 004C0127
Part of subcall function 004C00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,004E23B3,000000FF), ref: 004C0138
Part of subcall function 004C00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 004C014E
Part of subcall function 004C00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 004C015C
Part of subcall function 004C00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 004C016A
Part of subcall function 004C00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 004C0195
Part of subcall function 004C00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 004C01A0

___scrt_fastfail.LIBCMT ref: 004C00E7

Part of subcall function 004C00A3: __onexit.LIBCMT ref: 004C00A9

Strings

kernel32.dll, xrefs: 004C0133
SleepConditionVariableCS, xrefs: 004C0154
WakeAllConditionVariable, xrefs: 004C0162
InitializeConditionVariable, xrefs: 004C0148
api-ms-win-core-synch-l1-2-0.dll, xrefs: 004C0122

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: dbf21d34f3001d2a151b3bb90bccb96adea704dc4f819ba0f904a7c613597377
Instruction ID: 6c2f82869dfdd4773386cbe2da34441dc5111753cd25663a1b715ad3bea129a1
Opcode Fuzzy Hash: dbf21d34f3001d2a151b3bb90bccb96adea704dc4f819ba0f904a7c613597377
Instruction Fuzzy Hash: EA21F536A44310EBD7505BA5BC09F6ABBE4EB14B51F04053FF805A2391DFA89804AB98

Function 005144C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0053CC08), ref: 00514527
_wcslen.LIBCMT ref: 0051453B
_wcslen.LIBCMT ref: 00514599
_wcslen.LIBCMT ref: 005145F4
_wcslen.LIBCMT ref: 0051463F
_wcslen.LIBCMT ref: 005146A7

Part of subcall function 004BF9F2: _wcslen.LIBCMT ref: 004BF9FD

GetDriveTypeW.KERNEL32(?,00566BF0,00000061), ref: 00514743

Strings

all, xrefs: 00514531, 00514536
network, xrefs: 0051469D, 005146A2
unknown, xrefs: 00514708
removable, xrefs: 005145EA, 005145EF
cdrom, xrefs: 0051458F, 00514594
ramdisk, xrefs: 005146F1
fixed, xrefs: 00514635, 0051463A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: e655525d194f47f4eb8b4dbc077235dfafc27c285e42595528dfae4cff78798c
Instruction ID: a63713451305bb9b5e95bbcf04bf0a6a202a326ec4b41f88e9192dbae5ebc767
Opcode Fuzzy Hash: e655525d194f47f4eb8b4dbc077235dfafc27c285e42595528dfae4cff78798c
Instruction Fuzzy Hash: 43B12F716083029FD310DF28C890AAEBBE5FFA6768F50591DF096C7291D734D885CBA2

Function 0053911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 004B9BB2

DragQueryPoint.SHELL32(?,?), ref: 00539147

Part of subcall function 00537674: ClientToScreen.USER32(?,?), ref: 0053769A
Part of subcall function 00537674: GetWindowRect.USER32(?,?), ref: 00537710
Part of subcall function 00537674: PtInRect.USER32(?,?,00538B89), ref: 00537720

SendMessageW.USER32(?,000000B0,?,?), ref: 005391B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 005391BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 005391DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00539225
SendMessageW.USER32(?,000000B0,?,?), ref: 0053923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00539255
SendMessageW.USER32(?,000000B1,?,?), ref: 00539277
DragFinish.SHELL32(?), ref: 0053927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00539371

Strings

@GUI_DRAGID, xrefs: 005392E9
p#W, xrefs: 005392BB
@GUI_DROPID, xrefs: 0053929E
@GUI_DRAGFILE, xrefs: 00539320

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#W
API String ID: 221274066-2236016650
Opcode ID: ca085180430d7473952a7bb8fba63c39fa4f5e7015ca3461c1090a3fdf4522f0
Instruction ID: eb63af51b2c89c38649d1db84080aa5daedd85e8153adf6a5547767f40404814
Opcode Fuzzy Hash: ca085180430d7473952a7bb8fba63c39fa4f5e7015ca3461c1090a3fdf4522f0
Instruction Fuzzy Hash: FE616671108301AFC701EF65DC85DABBFE8FBA9354F00091EF595962A0DB709A49CB56

Function 004A326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00571990), ref: 004E2F8D
GetMenuItemCount.USER32(00571990), ref: 004E303D
GetCursorPos.USER32(?), ref: 004E3081
SetForegroundWindow.USER32(00000000), ref: 004E308A
TrackPopupMenuEx.USER32(00571990,00000000,?,00000000,00000000,00000000), ref: 004E309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 004E30A9

Strings

0, xrefs: 004A327D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 107d5e85da458b249cb7bbef8fcc6c07529a901ce220d97028b68b4c85b03d07
Instruction ID: 8d67a99d7f967b3226a4889ca9729b8be585e9b713a8b31b1fe7699efd84cfa2
Opcode Fuzzy Hash: 107d5e85da458b249cb7bbef8fcc6c07529a901ce220d97028b68b4c85b03d07
Instruction Fuzzy Hash: EA712531640256BAEB218F29CD49FABBF68FF11325F200207F5146A2E0C7B5AD14EB59

Function 00536CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00536DEB

Part of subcall function 004A6B57: _wcslen.LIBCMT ref: 004A6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00536E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00536E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00536E94
DestroyWindow.USER32(?), ref: 00536EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,004A0000,00000000), ref: 00536EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00536EFD
GetDesktopWindow.USER32 ref: 00536F16
GetWindowRect.USER32(00000000), ref: 00536F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00536F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00536F4D

Part of subcall function 004B9944: GetWindowLongW.USER32(?,000000EB), ref: 004B9952

Strings

0, xrefs: 00536D98
tooltips_class32, xrefs: 00536E58, 00536EDD

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 48feff9eddc77350ebeecab6344aa135f133e5699d890c0356a622b01c52262c
Instruction ID: 5468b89cc07e45afe29933024367efa7bfd829922c93d746e8a5336368a55633
Opcode Fuzzy Hash: 48feff9eddc77350ebeecab6344aa135f133e5699d890c0356a622b01c52262c
Instruction Fuzzy Hash: C8717974104644AFDB21CF19D884EAABFF9FB99304F04481DFA9997260C770A94AEB25

Function 0051C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0051C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0051C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0051C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0051C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0051C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0051C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0051C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0051C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0051C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0051C5F0
InternetCloseHandle.WININET(00000000), ref: 0051C5FB

Strings

, xrefs: 0051C575

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: d3a6877e9593b689641e9c0fd1256481a3e08860fb7047923fe14d7a1f25e378
Instruction ID: cb3f0047dd433d7e4374ab0fe1294ea3c476316b0fa4ac399a6d018bd6aa3d1a
Opcode Fuzzy Hash: d3a6877e9593b689641e9c0fd1256481a3e08860fb7047923fe14d7a1f25e378
Instruction Fuzzy Hash: 2F514BB5540209BFEB219FA4C988ABB7FFDFF18754F00441DF945A6210DB35E988AB60

Function 0053856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00538592
GetFileSize.KERNEL32(00000000,00000000), ref: 005385A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 005385AD
CloseHandle.KERNEL32(00000000), ref: 005385BA
GlobalLock.KERNEL32(00000000), ref: 005385C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 005385D7
GlobalUnlock.KERNEL32(00000000), ref: 005385E0
CloseHandle.KERNEL32(00000000), ref: 005385E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 005385F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,0053FC38,?), ref: 00538611
GlobalFree.KERNEL32(00000000), ref: 00538621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00538641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00538671
DeleteObject.GDI32(00000000), ref: 00538699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 005386AF

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: d4d420a6bdde58ab94a845125621d38b2abf30cb1e06101e2e38361421798733
Instruction ID: 19665ca89025ec6901560a66cd76ffdb5e3163cd074a2b1cb6ecc3132301e912
Opcode Fuzzy Hash: d4d420a6bdde58ab94a845125621d38b2abf30cb1e06101e2e38361421798733
Instruction Fuzzy Hash: 7141F775600208BFDB159FA5DC89EAB7FB8FF99B11F148058F905EB260DB309905EB60

Function 005114BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00511502
VariantCopy.OLEAUT32(?,?), ref: 0051150B
VariantClear.OLEAUT32(?), ref: 00511517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 005115FB
VarR8FromDec.OLEAUT32(?,?), ref: 00511657
VariantInit.OLEAUT32(?), ref: 00511708
SysFreeString.OLEAUT32(?), ref: 0051178C
VariantClear.OLEAUT32(?), ref: 005117D8
VariantClear.OLEAUT32(?), ref: 005117E7
VariantInit.OLEAUT32(00000000), ref: 00511823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00511625
Default, xrefs: 005116AF

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: ae5302183000ecaea36741922f7ae45d8aa3ed1d99a57a848b5959502bf7ee68
Instruction ID: 7ee395ee6442921ab0822e63318e684d8695f62e766200b47fd89aeb965e9cd8
Opcode Fuzzy Hash: ae5302183000ecaea36741922f7ae45d8aa3ed1d99a57a848b5959502bf7ee68
Instruction Fuzzy Hash: 5FD11331600915DBEB009F65E884BFDBBB6BF45700F15849AF646AB280DB34DC84DF6A

Function 0052B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

Part of subcall function 0052C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0052B6AE,?,?), ref: 0052C9B5
Part of subcall function 0052C998: _wcslen.LIBCMT ref: 0052C9F1
Part of subcall function 0052C998: _wcslen.LIBCMT ref: 0052CA68
Part of subcall function 0052C998: _wcslen.LIBCMT ref: 0052CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0052B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0052B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0052B80A
RegCloseKey.ADVAPI32(?), ref: 0052B87E
RegCloseKey.ADVAPI32(?), ref: 0052B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0052B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0052B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0052B922
FreeLibrary.KERNEL32(00000000), ref: 0052B983
RegCloseKey.ADVAPI32(00000000), ref: 0052B994

Strings

advapi32.dll, xrefs: 0052B8ED
RegDeleteKeyExW, xrefs: 0052B8FE

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 4b672bde09e2584b34f32becdfbcd0039aa88f8c6c050aad4742be5a2835a9d9
Instruction ID: 4aec42824a6337a5ed15aed5ffbcbbe60c83243123594eaefe9f2c7f6a14a48e
Opcode Fuzzy Hash: 4b672bde09e2584b34f32becdfbcd0039aa88f8c6c050aad4742be5a2835a9d9
Instruction Fuzzy Hash: A4C19B34208211AFE714DF14D494F2ABBE5FF96308F18845CF59A8B2A2CB35ED45CB91

Function 0052255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 005225D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 005225E8
CreateCompatibleDC.GDI32(?), ref: 005225F4
SelectObject.GDI32(00000000,?), ref: 00522601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0052266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 005226AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 005226D0
SelectObject.GDI32(?,?), ref: 005226D8
DeleteObject.GDI32(?), ref: 005226E1
DeleteDC.GDI32(?), ref: 005226E8
ReleaseDC.USER32(00000000,?), ref: 005226F3

Strings

(, xrefs: 0052268D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 9e115f95beb463c8e3e1da2575aa4a92bb1985ba7c3731dc1202927bb900aab0
Instruction ID: 9b1c1261533bd6357d10272d2fd98ec37deb40c57653a8b209b246ba190b801d
Opcode Fuzzy Hash: 9e115f95beb463c8e3e1da2575aa4a92bb1985ba7c3731dc1202927bb900aab0
Instruction Fuzzy Hash: 5061F376D00219EFCF14CFA8D888AAEBBB5FF48310F208529E956A7350D774A951DF60

Function 004DDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 004DDAA1

Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD659
Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD66B
Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD67D
Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD68F
Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD6A1
Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD6B3
Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD6C5
Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD6D7
Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD6E9
Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD6FB
Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD70D
Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD71F
Part of subcall function 004DD63C: _free.LIBCMT ref: 004DD731

_free.LIBCMT ref: 004DDA96

Part of subcall function 004D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,004DD7D1,00000000,00000000,00000000,00000000,?,004DD7F8,00000000,00000007,00000000,?,004DDBF5,00000000), ref: 004D29DE
Part of subcall function 004D29C8: GetLastError.KERNEL32(00000000,?,004DD7D1,00000000,00000000,00000000,00000000,?,004DD7F8,00000000,00000007,00000000,?,004DDBF5,00000000,00000000), ref: 004D29F0

_free.LIBCMT ref: 004DDAB8
_free.LIBCMT ref: 004DDACD
_free.LIBCMT ref: 004DDAD8
_free.LIBCMT ref: 004DDAFA
_free.LIBCMT ref: 004DDB0D
_free.LIBCMT ref: 004DDB1B
_free.LIBCMT ref: 004DDB26
_free.LIBCMT ref: 004DDB5E
_free.LIBCMT ref: 004DDB65
_free.LIBCMT ref: 004DDB82
_free.LIBCMT ref: 004DDB9A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 98cc1e119b8e890d0e33df2ba99b5195b3620c41dd7960fb1d665379eea6c098
Instruction ID: deedefea6e1deecc08169e9ec2671c724cbefa79ec650addd1d9ecc39fe635d0
Opcode Fuzzy Hash: 98cc1e119b8e890d0e33df2ba99b5195b3620c41dd7960fb1d665379eea6c098
Instruction Fuzzy Hash: E0317CB1A046049FEB21AA3AE961B577BE8FF10318F10446FE049D7391DA78BC40D728

Function 0050365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0050369C
_wcslen.LIBCMT ref: 005036A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00503797
GetClassNameW.USER32(?,?,00000400), ref: 0050380C
GetDlgCtrlID.USER32(?), ref: 0050385D
GetWindowRect.USER32(?,?), ref: 00503882
GetParent.USER32(?), ref: 005038A0
ScreenToClient.USER32(00000000), ref: 005038A7
GetClassNameW.USER32(?,?,00000100), ref: 00503921
GetWindowTextW.USER32(?,?,00000400), ref: 0050395D

Strings

%s%u, xrefs: 00503734

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 60239a1638bfc70ccb31a95b687c7cf4721468f92228fe7f42c7764cf60ce0b6
Instruction ID: 48ac905e4ed89b1f4f929e18e9261c795f80ed34b215b962aa95f202be383e7e
Opcode Fuzzy Hash: 60239a1638bfc70ccb31a95b687c7cf4721468f92228fe7f42c7764cf60ce0b6
Instruction Fuzzy Hash: EC919E71204606AFD719DF25C885FAEBBACFF44354F008A29F999D2191DB30EA49CB91

Function 00504954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00504994
GetWindowTextW.USER32(?,?,00000400), ref: 005049DA
_wcslen.LIBCMT ref: 005049EB
CharUpperBuffW.USER32(?,00000000), ref: 005049F7
_wcsstr.LIBVCRUNTIME ref: 00504A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00504A64
GetWindowTextW.USER32(?,?,00000400), ref: 00504A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00504AE6
GetClassNameW.USER32(?,?,00000400), ref: 00504B20
GetWindowRect.USER32(?,?), ref: 00504B8B

Strings

ThumbnailClass, xrefs: 00504A6F, 00504AF1

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 164d7c8d679c85072f6c32997fe6ebc04f94c86eb83d89dee7b5af64b73383aa
Instruction ID: a931947d9d0b7f6861d353dab2a60f2c6b216cbe2c0d553b804596f9d54346b1
Opcode Fuzzy Hash: 164d7c8d679c85072f6c32997fe6ebc04f94c86eb83d89dee7b5af64b73383aa
Instruction Fuzzy Hash: 4591A9B21042069BDB04DE14C985BAE7BE9FF84314F04846EFE859A1D6EB34ED45CFA1

Function 0050BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00571990,000000FF,00000000,00000030), ref: 0050BFAC
SetMenuItemInfoW.USER32(00571990,00000004,00000000,00000030), ref: 0050BFE1
Sleep.KERNEL32(000001F4), ref: 0050BFF3
GetMenuItemCount.USER32(?), ref: 0050C039
GetMenuItemID.USER32(?,00000000), ref: 0050C056
GetMenuItemID.USER32(?,-00000001), ref: 0050C082
GetMenuItemID.USER32(?,?), ref: 0050C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0050C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0050C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0050C145

Strings

0, xrefs: 0050BF3D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: b62b760dc49828ee6513ea1bdd80642df033ee7d661ea28e4f5817b3533dbbca
Instruction ID: be0bd650ccf0a1acdb94d373a103cc9c8eb5c1a4aae12104186244de7fcfad36
Opcode Fuzzy Hash: b62b760dc49828ee6513ea1bdd80642df033ee7d661ea28e4f5817b3533dbbca
Instruction Fuzzy Hash: 57618DB090024AAFEF11CF68DD88AAEBFA8FB46344F000655E801A32D1D775AD45DB60

Function 0052CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0052CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0052CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0052CD48

Part of subcall function 0052CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0052CCAA
Part of subcall function 0052CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0052CCBD
Part of subcall function 0052CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0052CCCF
Part of subcall function 0052CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0052CD05
Part of subcall function 0052CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0052CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0052CCF3

Strings

advapi32.dll, xrefs: 0052CCB8
RegDeleteKeyExW, xrefs: 0052CCC9

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 8b4edc9e74aba6143be390d43e14390376151eca886d12d89a8a501583ee4e5a
Instruction ID: 6db114bad807b9cbad1002572585780735186ac5a4f97658cfb9a9fd1d53c1f2
Opcode Fuzzy Hash: 8b4edc9e74aba6143be390d43e14390376151eca886d12d89a8a501583ee4e5a
Instruction Fuzzy Hash: 84317E75901129BBD7208B61EC88EFFBF7CEF56740F000165A905E7281D6749E49EBA0

Function 00513D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00513D40
_wcslen.LIBCMT ref: 00513D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00513D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00513DBE
RemoveDirectoryW.KERNEL32(?), ref: 00513DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00513E55
CloseHandle.KERNEL32(00000000), ref: 00513E60
CloseHandle.KERNEL32(00000000), ref: 00513E6B

Strings

:, xrefs: 00513D82
\, xrefs: 00513D77
\??\%s, xrefs: 00513D5B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: a56174fe1fcee9f113a27f1d03f22902757b4226ec9838c321e3df6a6b3d7eca
Instruction ID: 8e7c9ef9f417ae2dff29740a8ad81639e5291c9524bb26583a98c0c7ad5267b1
Opcode Fuzzy Hash: a56174fe1fcee9f113a27f1d03f22902757b4226ec9838c321e3df6a6b3d7eca
Instruction Fuzzy Hash: 3C31A5B59001096BDB209BA0DC49FEF3BBCFF88744F1041BAF505E6160E77497849B64

Function 0050E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0050E6B4

Part of subcall function 004BE551: timeGetTime.WINMM(?,?,0050E6D4), ref: 004BE555

Sleep.KERNEL32(0000000A), ref: 0050E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0050E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0050E727
SetActiveWindow.USER32 ref: 0050E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0050E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0050E773
Sleep.KERNEL32(000000FA), ref: 0050E77E
IsWindow.USER32 ref: 0050E78A
EndDialog.USER32(00000000), ref: 0050E79B

Strings

BUTTON, xrefs: 0050E719

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 1ad05a4230f8f29608a642b771e30423434a7447c2617be6c0046de1ee83b5f2
Instruction ID: 1a94f07a8a7a115e7d1c046ff75c887a15d54f5f9cbbcc2e2ed8e3b49abae250
Opcode Fuzzy Hash: 1ad05a4230f8f29608a642b771e30423434a7447c2617be6c0046de1ee83b5f2
Instruction Fuzzy Hash: 1A218470200245AFEB106F65FC8FA293F69F7B5349F240825F50A912E1DF719C48BB24

Function 0050E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0050EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0050EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0050EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0050EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0050EAA7

Strings

close PlayMe, xrefs: 0050EA6E, 0050EA9B
alias PlayMe, xrefs: 0050EA36
play PlayMe wait, xrefs: 0050EA91
play PlayMe, xrefs: 0050EAA2
status PlayMe mode, xrefs: 0050EA58
open , xrefs: 0050EA0C

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 6eabcaf0e3f314ac374f1511746dbfbe0bb54dae046ecabcf54a6f944b367039
Instruction ID: d8f406910ea528a73db19f0ec0ccd40b0b39d835c3605cb2a789414c68b0d581
Opcode Fuzzy Hash: 6eabcaf0e3f314ac374f1511746dbfbe0bb54dae046ecabcf54a6f944b367039
Instruction Fuzzy Hash: C6114F21A5021979D720A7A2DC4ADFF6E7CFBE6B44F14082A7801A30D1EAB00945CAB0

Function 00505CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00505CE2
GetWindowRect.USER32(00000000,?), ref: 00505CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00505D59
GetDlgItem.USER32(?,00000002), ref: 00505D69
GetWindowRect.USER32(00000000,?), ref: 00505D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00505DCF
GetDlgItem.USER32(?,000003E9), ref: 00505DDD
GetWindowRect.USER32(00000000,?), ref: 00505DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00505E31
GetDlgItem.USER32(?,000003EA), ref: 00505E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00505E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00505E67

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: df5f69948ec092bba896b77ff816d45ec39d1de741ebb2be8d72b5b0148590c9
Instruction ID: f9c800539618f18f003f89fab0cef91d818f1fa52dca7feda00e8879f97a90c1
Opcode Fuzzy Hash: df5f69948ec092bba896b77ff816d45ec39d1de741ebb2be8d72b5b0148590c9
Instruction Fuzzy Hash: F751FFB1A00615AFDF18CF68DD89AAE7FB9FB58300F548129F916E6290E7709E04CF50

Function 004B8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 004B8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,004B8BE8,?,00000000,?,?,?,?,004B8BBA,00000000,?), ref: 004B8FC5

DestroyWindow.USER32(?), ref: 004B8C81
KillTimer.USER32(00000000,?,?,?,?,004B8BBA,00000000,?), ref: 004B8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 004F6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,004B8BBA,00000000,?), ref: 004F69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,004B8BBA,00000000,?), ref: 004F69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,004B8BBA,00000000), ref: 004F69D4
DeleteObject.GDI32(00000000), ref: 004F69E6

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 8d2c14503aae7d0f0db5aa0f7451f626d0bd624e202697f8829c5504e36be708
Instruction ID: 0ffe65857a4a6104de1ee9ed2aaf68c0c8e2ef098864a2a758ddce31cb3fb0c2
Opcode Fuzzy Hash: 8d2c14503aae7d0f0db5aa0f7451f626d0bd624e202697f8829c5504e36be708
Instruction Fuzzy Hash: 0161ED71401A04DFCB218F18E948BBA7BF5FB60312F14441EE1469A660CB79ACD5EF69

Function 004B9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 004B9944: GetWindowLongW.USER32(?,000000EB), ref: 004B9952

GetSysColor.USER32(0000000F), ref: 004B9862

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 66c728d6585e4d2dbfe8fd3f73dc9d80dc4a85346f81b767dca7640a280fa93a
Instruction ID: e1c4d7e8390111c8b1881c753340aeb85864a8b0836f2243cd159130a76fe509
Opcode Fuzzy Hash: 66c728d6585e4d2dbfe8fd3f73dc9d80dc4a85346f81b767dca7640a280fa93a
Instruction Fuzzy Hash: F441C431104604AFDB216F389C84BFA3B75AB16330F14465AFAA2973E1D7399C46EB25

Function 004D8D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.L, xrefs: 004D903A, 004D8FD0, 004D8FF2

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID: .L
API String ID: 0-3603714933
Opcode ID: 160a82fc00ce5b267af3187d4b20314e4be468c282cdd48c4527d91b73ac8263
Instruction ID: 5d495f89181475c81ce67810e2fef424694c7fba3e6c44943544d006de5f128b
Opcode Fuzzy Hash: 160a82fc00ce5b267af3187d4b20314e4be468c282cdd48c4527d91b73ac8263
Instruction Fuzzy Hash: E6C11674A04249AFDB12DFA9D861BAEBBB1AF19310F04409FF414E7392C7389D41DB69

Function 005096E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,004EF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00509717
LoadStringW.USER32(00000000,?,004EF7F8,00000001), ref: 00509720

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,004EF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00509742
LoadStringW.USER32(00000000,?,004EF7F8,00000001), ref: 00509745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00509866

Strings

Line %d:, xrefs: 005097A0
^ ERROR, xrefs: 005097FB
%s (%d) : ==> %s: %s %s, xrefs: 0050984A
Error: , xrefs: 0050981D
Line %d (File "%s"):, xrefs: 0050978F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 4e4c959228f33884ca16e0964df127098b3964859083188dbe8fd9745ff3d620
Instruction ID: a0b2fd0b3c6eaa8cdeaa6f3e5001819f0f3062b878ab515956624fc0ccca705d
Opcode Fuzzy Hash: 4e4c959228f33884ca16e0964df127098b3964859083188dbe8fd9745ff3d620
Instruction Fuzzy Hash: E5415D72804219AACF04FBE1CD86DEE7B78EF66745F10442AF50572092EB396F48CB65

Function 005006DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 004A6B57: _wcslen.LIBCMT ref: 004A6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 005007A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 005007BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 005007DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00500804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0050082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00500837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0050083C

Strings

\CLSID, xrefs: 00500724
SOFTWARE\Classes\, xrefs: 0050070E
\IPC$, xrefs: 00500784

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: aebb548adbbda032f65899e572022f5d49829763803fa6f4c75cb07860deae15
Instruction ID: 2696c5b0387fcca0f872c5d2de01240a5262771d7eda8782b5f5f45bfa89db6b
Opcode Fuzzy Hash: aebb548adbbda032f65899e572022f5d49829763803fa6f4c75cb07860deae15
Instruction Fuzzy Hash: DC41F872C10229ABDF15EFA5DC859EDBB78FF14754F04412AE901B31A1EB749E18CBA0

Function 00523C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00523C5C
CoInitialize.OLE32(00000000), ref: 00523C8A
CoUninitialize.OLE32 ref: 00523C94
_wcslen.LIBCMT ref: 00523D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00523DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00523ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00523F0E
CoGetObject.OLE32(?,00000000,0053FB98,?), ref: 00523F2D
SetErrorMode.KERNEL32(00000000), ref: 00523F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00523FC4
VariantClear.OLEAUT32(?), ref: 00523FD8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 8364a4c9f92b6c5eee56b63d04015b0e4fae25864ae2c0352ebd03e2d32acff4
Instruction ID: a7f303e1adb70a2d37ba5c559a044fb0ef36d4f5dbe9948544aa0fd6bfac5639
Opcode Fuzzy Hash: 8364a4c9f92b6c5eee56b63d04015b0e4fae25864ae2c0352ebd03e2d32acff4
Instruction Fuzzy Hash: B7C15771608315AFC700DF68D88492BBBE9FF8A748F14491DF98A9B291D734EE05CB52

Function 00517A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00517AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00517B8F
SHGetDesktopFolder.SHELL32(?), ref: 00517BA3
CoCreateInstance.OLE32(0053FD08,00000000,00000001,00566E6C,?), ref: 00517BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00517C74
CoTaskMemFree.OLE32(?,?), ref: 00517CCC
SHBrowseForFolderW.SHELL32(?), ref: 00517D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00517D7A
CoTaskMemFree.OLE32(00000000), ref: 00517D81
CoTaskMemFree.OLE32(00000000), ref: 00517DD6
CoUninitialize.OLE32 ref: 00517DDC

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: b9ca6ef78c5ce2ad518ae75b9f9c75c515b02331c740e2cfb73fc9cac1b5c439
Instruction ID: 82b050ac2a227a82a2a705f3640076e09178bba707cc5d3f01625138ec68f879
Opcode Fuzzy Hash: b9ca6ef78c5ce2ad518ae75b9f9c75c515b02331c740e2cfb73fc9cac1b5c439
Instruction Fuzzy Hash: 77C11D75A04109AFDB14DF68C884DAEBBF9FF48318B148499E415DB361D734EE85CB90

Function 0053541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00535504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00535515
CharNextW.USER32(00000158), ref: 00535544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00535585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0053559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005355AC

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: edfda1449d0c83e5d09aaf5ad7616dc23a7033d2f6a39d3058334995ff652ae7
Instruction ID: 01c84ee4bf98b98e412f5b786496ba899deca2096dbbf92e8cd0c1390265ce89
Opcode Fuzzy Hash: edfda1449d0c83e5d09aaf5ad7616dc23a7033d2f6a39d3058334995ff652ae7
Instruction Fuzzy Hash: 6E61AC71900609AFDF11CF64CC85AFE7FB9FB19320F109545F925AB290E7749A84EB60

Function 004FFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 004FFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 004FFB08
VariantInit.OLEAUT32(?), ref: 004FFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 004FFB3A
VariantCopy.OLEAUT32(?,?), ref: 004FFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 004FFBA1
VariantClear.OLEAUT32(?), ref: 004FFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 004FFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 004FFBCC
VariantClear.OLEAUT32(?), ref: 004FFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 004FFBE9

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: e5a8665b84ee5db8c6945a4c4b018d05549a80aac1d2a98816fd913a8865acb5
Instruction ID: f01f0c918462a579b2a10c74e74cba99f95a18089f87b0b6cbb072d64ded7d8d
Opcode Fuzzy Hash: e5a8665b84ee5db8c6945a4c4b018d05549a80aac1d2a98816fd913a8865acb5
Instruction Fuzzy Hash: 49415F35A002199FCF00DF65D8549BEBFB9FF58345F00806AE915A7361DB34E949CBA4

Function 00509C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00509CA1
GetAsyncKeyState.USER32(000000A0), ref: 00509D22
GetKeyState.USER32(000000A0), ref: 00509D3D
GetAsyncKeyState.USER32(000000A1), ref: 00509D57
GetKeyState.USER32(000000A1), ref: 00509D6C
GetAsyncKeyState.USER32(00000011), ref: 00509D84
GetKeyState.USER32(00000011), ref: 00509D96
GetAsyncKeyState.USER32(00000012), ref: 00509DAE
GetKeyState.USER32(00000012), ref: 00509DC0
GetAsyncKeyState.USER32(0000005B), ref: 00509DD8
GetKeyState.USER32(0000005B), ref: 00509DEA

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: f1820fb13b228d7442c454a2cff7baefad62b4b605092afde87a84beb4264acd
Instruction ID: 2abf1fab67ace184510465ff55488f267cef4eec682982290329927f270f59ff
Opcode Fuzzy Hash: f1820fb13b228d7442c454a2cff7baefad62b4b605092afde87a84beb4264acd
Instruction Fuzzy Hash: 4C41E9749447C96EFF308764C8043BDBEA07F21344F08805ADAC6566C7DBA49DC8C7A2

Function 0052055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 005205BC
inet_addr.WSOCK32(?), ref: 0052061C
gethostbyname.WSOCK32(?), ref: 00520628
IcmpCreateFile.IPHLPAPI ref: 00520636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 005206C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 005206E5
IcmpCloseHandle.IPHLPAPI(?), ref: 005207B9
WSACleanup.WSOCK32 ref: 005207BF

Strings

Ping, xrefs: 00520676

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 429c5f98a621a8fa517620cc3b3a871651079b18b24f66b4636452ba233ee1b3
Instruction ID: 6b17e86de30da17cab5b57ea1012cae1549cff01183f176aa978879e71fb49ad
Opcode Fuzzy Hash: 429c5f98a621a8fa517620cc3b3a871651079b18b24f66b4636452ba233ee1b3
Instruction Fuzzy Hash: 51917935605211AFD320DF15E888B1ABFE0FF46318F1889A9E4699B6E2C734ED45CF91

Function 00528CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00528CF3

Part of subcall function 00508E54: _wcslen.LIBCMT ref: 00508E77

_wcslen.LIBCMT ref: 00528D4E
_wcslen.LIBCMT ref: 00528D9C
_wcslen.LIBCMT ref: 00528DDC
_wcslen.LIBCMT ref: 00528E6E

Strings

cdecl, xrefs: 00528D48, 00528D4D
winapi, xrefs: 00528D96, 00528D9B
none, xrefs: 00528E65, 00528E6A
stdcall, xrefs: 00528DD6, 00528DDB

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: ae159241b59b2396dd98815cf8e398e2e71f622cd946b0f7b31a048f78137d8c
Instruction ID: aa2cbf5f3f3e15de1abfc1bb2b60264e444d8d2286958a1812419128fb275fb3
Opcode Fuzzy Hash: ae159241b59b2396dd98815cf8e398e2e71f622cd946b0f7b31a048f78137d8c
Instruction Fuzzy Hash: 6A51D472A011269BCF14DFACD9409BEBBA9BF66324B25422DE426E72C4DF34DD44C790

Function 0052372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00523774
CoUninitialize.OLE32 ref: 0052377F
CoCreateInstance.OLE32(?,00000000,00000017,0053FB78,?), ref: 005237D9
IIDFromString.OLE32(?,?), ref: 0052384C
VariantInit.OLEAUT32(?), ref: 005238E4
VariantClear.OLEAUT32(?), ref: 00523936

Strings

NULL Pointer assignment, xrefs: 0052381E
Invalid parameter, xrefs: 00523865
Failed to create object, xrefs: 005237E4, 0052389A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: d1df004feeff939532d2bb1a97a36d19478e1fe3bdc8669ae3fca2888a88bcd4
Instruction ID: bcbd6edc6d23a42c83e1c0884942b993beb49d7604ee5e294e4911fa4f8c5a39
Opcode Fuzzy Hash: d1df004feeff939532d2bb1a97a36d19478e1fe3bdc8669ae3fca2888a88bcd4
Instruction Fuzzy Hash: 26619D71608321AFD710DF54D888B5ABFE8FF8A714F040809F9859B291D774EE48CB96

Function 00513388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 005133CF

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 005133F0

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00513504
Incorrect parameters to object property !, xrefs: 005134AB
Error: , xrefs: 005134D1
"%s" (%d) : ==> %s:, xrefs: 00513522
^ ERROR , xrefs: 0051349E
Line %d (File "%s"):, xrefs: 00513443, 0051345C

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 28caa4ef0ba8abf8fb9d3134e86907cbf4ecdbc72878fe634dcf85e13f30349e
Instruction ID: ddd900c4a691f45d423b2e47251dfbca31192f9ccdd6d0b8d10133036a560ad8
Opcode Fuzzy Hash: 28caa4ef0ba8abf8fb9d3134e86907cbf4ecdbc72878fe634dcf85e13f30349e
Instruction Fuzzy Hash: EE51D131800609AADF14EBE1CD46EEEBB79FF25744F10446AF40572092EB392F98DB64

Function 0050B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0050B5FC
_wcslen.LIBCMT ref: 0050B608
_wcslen.LIBCMT ref: 0050B64D
_wcslen.LIBCMT ref: 0050B68C
_wcslen.LIBCMT ref: 0050B6C7

Strings

APPEND, xrefs: 0050B6C1, 0050B6C6
REMOVE, xrefs: 0050B602, 0050B607
KEYS, xrefs: 0050B647, 0050B64C
EXISTS, xrefs: 0050B686, 0050B68B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 1db5f7c13cfc998cb97f3b89e52b6b0e93ec6a96c512f19277f1dd354d0dbd4b
Instruction ID: 48ef014b00cca67275503c182449dfd1c39a26646abe45f0f60504ee8e7d69a3
Opcode Fuzzy Hash: 1db5f7c13cfc998cb97f3b89e52b6b0e93ec6a96c512f19277f1dd354d0dbd4b
Instruction Fuzzy Hash: 2841A532A001279ADB205F7DC9D15BE7FA5FBA1B98B24462AE421D72C4E736CD81C790

Function 00515393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 005153A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00515416
GetLastError.KERNEL32 ref: 00515420
SetErrorMode.KERNEL32(00000000,READY), ref: 005154A7

Strings

READY, xrefs: 00515460, 00515468
NOTREADY, xrefs: 0051544B
INVALID, xrefs: 00515459
READONLY, xrefs: 00515452
UNKNOWN, xrefs: 00515444

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 14b3bc5a604ef15ca7cf6afaac65180085a0b54952e8c500077f3131bcd828f6
Instruction ID: 059beca7580130568db00309c0de80128a5ccec77786e27001c0153fb589cd9c
Opcode Fuzzy Hash: 14b3bc5a604ef15ca7cf6afaac65180085a0b54952e8c500077f3131bcd828f6
Instruction Fuzzy Hash: AC317E35A00605DFEB10DF68C484AEABFB4FB95309F54806AE405DB292E7B5DDC6CB90

Function 00533C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00533C79
SetMenu.USER32(?,00000000), ref: 00533C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00533D10
IsMenu.USER32(?), ref: 00533D24
CreatePopupMenu.USER32 ref: 00533D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00533D5B
DrawMenuBar.USER32 ref: 00533D63

Strings

0, xrefs: 00533C54
F, xrefs: 00533D4E

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 8d9e3b9ec75c9a3297a90a7504ae6bb1a1bbc93e03b3a8628e77e4459fb648ea
Instruction ID: 2285014adfdbf5a7519a4fffe083803df5cc1e9377cd4aa397e4987308fbf736
Opcode Fuzzy Hash: 8d9e3b9ec75c9a3297a90a7504ae6bb1a1bbc93e03b3a8628e77e4459fb648ea
Instruction Fuzzy Hash: 0F418779A01209AFDB14CFA4E884EAA7FB5FF59340F140429FA06A7360D730AA14DF94

Function 00501EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

Part of subcall function 00503CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00503CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00501F64
GetDlgCtrlID.USER32 ref: 00501F6F
GetParent.USER32 ref: 00501F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00501F8E
GetDlgCtrlID.USER32(?), ref: 00501F97
GetParent.USER32(?), ref: 00501FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00501FAE

Strings

ComboBox, xrefs: 00501EEC
ListBox, xrefs: 00501F21

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: eb672db4c0689d02ff7d67961a52131ede8886839906b1b10ec47ec4d2b826fe
Instruction ID: 2e5f3b12b162df403ba37323354dd940c31404aa52179b6c2153ba08a0061366
Opcode Fuzzy Hash: eb672db4c0689d02ff7d67961a52131ede8886839906b1b10ec47ec4d2b826fe
Instruction Fuzzy Hash: C621AC70900614ABCF04AFA4CC859EEBFA8FF26354B00411AF961AB2E1DB3859089B64

Function 00533A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00533A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00533AA0
GetWindowLongW.USER32(?,000000F0), ref: 00533AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00533AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00533B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00533BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00533BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00533BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00533BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00533C13

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 29f975b7a8da00dce649491caa952d7535209679109c96d45fece63460316665
Instruction ID: 9fc59aa07a750d98f656187a521d0b694c45ccee50fc2203df15d0926787a820
Opcode Fuzzy Hash: 29f975b7a8da00dce649491caa952d7535209679109c96d45fece63460316665
Instruction Fuzzy Hash: DE616C75900248AFDB10DFA8CC81EEE7BB8FF49700F104199FA15AB2A1C774AE45EB54

Function 0050B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0050B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0050A1E1,?,00000001), ref: 0050B165
GetWindowThreadProcessId.USER32(00000000), ref: 0050B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0050A1E1,?,00000001), ref: 0050B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0050B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0050A1E1,?,00000001), ref: 0050B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0050A1E1,?,00000001), ref: 0050B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0050A1E1,?,00000001), ref: 0050B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0050A1E1,?,00000001), ref: 0050B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0050A1E1,?,00000001), ref: 0050B21D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 238368087bb4f8b621feac6a98b8d40fefed73f8f4991244ca08f820665f35f7
Instruction ID: f32cafe578e4d2cba51db7610f8b83646a7fd66140f7b5ce0a649cc1c31d350d
Opcode Fuzzy Hash: 238368087bb4f8b621feac6a98b8d40fefed73f8f4991244ca08f820665f35f7
Instruction Fuzzy Hash: 59319E75500205BFEB109F24EC89B6D7FA9BB71321F144445FA09E62D0E7B49A88FF60

Function 004D2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004D2C94

Part of subcall function 004D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,004DD7D1,00000000,00000000,00000000,00000000,?,004DD7F8,00000000,00000007,00000000,?,004DDBF5,00000000), ref: 004D29DE
Part of subcall function 004D29C8: GetLastError.KERNEL32(00000000,?,004DD7D1,00000000,00000000,00000000,00000000,?,004DD7F8,00000000,00000007,00000000,?,004DDBF5,00000000,00000000), ref: 004D29F0

_free.LIBCMT ref: 004D2CA0
_free.LIBCMT ref: 004D2CAB
_free.LIBCMT ref: 004D2CB6
_free.LIBCMT ref: 004D2CC1
_free.LIBCMT ref: 004D2CCC
_free.LIBCMT ref: 004D2CD7
_free.LIBCMT ref: 004D2CE2
_free.LIBCMT ref: 004D2CED
_free.LIBCMT ref: 004D2CFB

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7ce36d871b2fa0528623e741effecd265645dda3af32ce45def24a5bc05f2501
Instruction ID: 35f46ee5ae1dd6aff86f37427d871979491014b9d5e2e5680438cee9d1a45efd
Opcode Fuzzy Hash: 7ce36d871b2fa0528623e741effecd265645dda3af32ce45def24a5bc05f2501
Instruction Fuzzy Hash: 111107B6200008AFCB02EF55DA62CDD3BA5FF15344F4040ABFA485F322D6B5EE50AB94

Function 004A1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 004A1459
OleUninitialize.OLE32(?,00000000), ref: 004A14F8
UnregisterHotKey.USER32(?), ref: 004A16DD
DestroyWindow.USER32(?), ref: 004E24B9
FreeLibrary.KERNEL32(?), ref: 004E251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 004E254B

Strings

close all, xrefs: 004A1454

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 95fbf50e21927a947724b586490fac8aef09a02d01919f402d7b03a227429893
Instruction ID: 47f5ede655ac8e654f648aa4a15fabc1e6cd68a2bbaf885e610689a82c0404a5
Opcode Fuzzy Hash: 95fbf50e21927a947724b586490fac8aef09a02d01919f402d7b03a227429893
Instruction Fuzzy Hash: C7D1CF31701212DFCB19EF16CA99A29F7A4BF16304F14429EE44A6B361CB38ED12CF59

Function 00517DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00517FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00517FC1
GetFileAttributesW.KERNEL32(?), ref: 00517FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00518005
SetCurrentDirectoryW.KERNEL32(?), ref: 00518017
SetCurrentDirectoryW.KERNEL32(?), ref: 00518060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 005180B0

Strings

*.*, xrefs: 00518066

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: cf7e9ad9399bef999ebc1150cd7b41b7c2535603f4cbe325f2a52e8230435161
Instruction ID: 3a34477c4787fce85e5aab89a4cdd93863a1488a4d8a8bbf3095ab6db0372a12
Opcode Fuzzy Hash: cf7e9ad9399bef999ebc1150cd7b41b7c2535603f4cbe325f2a52e8230435161
Instruction Fuzzy Hash: C181A2725082099BEB20EF29C8449EEBBE8BF99314F144D5EF885D7250DB34DD89CB52

Function 004A5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 004A5C7A

Part of subcall function 004A5D0A: GetClientRect.USER32(?,?), ref: 004A5D30
Part of subcall function 004A5D0A: GetWindowRect.USER32(?,?), ref: 004A5D71
Part of subcall function 004A5D0A: ScreenToClient.USER32(?,?), ref: 004A5D99

GetDC.USER32 ref: 004E46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 004E4708
SelectObject.GDI32(00000000,00000000), ref: 004E4716
SelectObject.GDI32(00000000,00000000), ref: 004E472B
ReleaseDC.USER32(?,00000000), ref: 004E4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 004E47C4

Strings

U, xrefs: 004E4693

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: c70b6c5318f7ecffd1a834e929649acec6d37864fa24d86bee4a30b309c7444c
Instruction ID: df916a91e8fce3bb8cb0bee0f6e27104510c70e1706832ac79feaa743a01f05f
Opcode Fuzzy Hash: c70b6c5318f7ecffd1a834e929649acec6d37864fa24d86bee4a30b309c7444c
Instruction Fuzzy Hash: 66710530400245DFCF218F65C984ABB7BB1FF9A326F14426BED555A26AC3388C42EF55

Function 0051359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 005135E4

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

LoadStringW.USER32(00572390,?,00000FFF,?), ref: 0051360A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00513724
^ ERROR, xrefs: 005136C9
Error: , xrefs: 005136EF
"%s" (%d) : ==> %s:, xrefs: 00513742
Line %d (File "%s"):, xrefs: 0051366B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 7baa06b5a1b907036ca3c97cdb890b87f34e9a68998cea56e65a918f4a4f64df
Instruction ID: 11b05afda2af11479e8830c5d0ac4894c090aacd9b13e9db75666fd0f32637a3
Opcode Fuzzy Hash: 7baa06b5a1b907036ca3c97cdb890b87f34e9a68998cea56e65a918f4a4f64df
Instruction Fuzzy Hash: 15518F7180061AAADF15EBA1DC52EEEBF38FF25345F04412AF505721A1EB341B98DFA4

Function 0051C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0051C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0051C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0051C2CA
GetLastError.KERNEL32 ref: 0051C322
SetEvent.KERNEL32(?), ref: 0051C336
InternetCloseHandle.WININET(00000000), ref: 0051C341

Strings

, xrefs: 0051C2BB

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 7269dd3adef17f190c1fe6383c8332775d4924606132a744ba031e6406bc0055
Instruction ID: d10c81c58f0b547d8494fd48964d35f418f2d83d9ddb9fc531af50f97aafb782
Opcode Fuzzy Hash: 7269dd3adef17f190c1fe6383c8332775d4924606132a744ba031e6406bc0055
Instruction Fuzzy Hash: AB317FB5540204AFE7219F658C88AAB7FFCFB59744B10891EF496E2200DB36DD889B61

Function 0050989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,004E3AAF,?,?,Bad directive syntax error,0053CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 005098BC
LoadStringW.USER32(00000000,?,004E3AAF,?), ref: 005098C3

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00509987

Strings

Line %d:, xrefs: 00509912
%s (%d) : ==> %s.: %s %s, xrefs: 005098F1
Error: , xrefs: 00509955
., xrefs: 0050996D
Line %d (File "%s"):, xrefs: 0050992D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 3e2e293cbcb8ce0da8347790aa1ce861e290a8334adcbfa5d3d4a4eeab43dd9a
Instruction ID: 55352abe0a5d5392dcba7d132544e1ae1cb0826491a896ffc1ab1acaf95d5193
Opcode Fuzzy Hash: 3e2e293cbcb8ce0da8347790aa1ce861e290a8334adcbfa5d3d4a4eeab43dd9a
Instruction Fuzzy Hash: 30219132D0421AABCF11AF91CC06EEE7B35FF29705F04481AF515620A2EB759A28DB54

Function 0050209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 005020AB
GetClassNameW.USER32(00000000,?,00000100), ref: 005020C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0050214D

Strings

details, xrefs: 005020FB
largeicons, xrefs: 005020E1
SHELLDLL_DefView, xrefs: 005020CC
list, xrefs: 0050212F
smallicons, xrefs: 00502115

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: a93ad085244dcd71b086df11af149b7c9136e60f9a1bb3ed2836f79d36827404
Instruction ID: c992fdf1517130b4b2b66343ffa6d778474ac0325413b8eda6f04a84a396b063
Opcode Fuzzy Hash: a93ad085244dcd71b086df11af149b7c9136e60f9a1bb3ed2836f79d36827404
Instruction Fuzzy Hash: 49113A7A2C8306B9F6156221DC0FDBE7F9CEB14328F20001EFB05A50E1FE6568459618

Function 004DCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004DCEB7
_free.LIBCMT ref: 004DCF22
_free.LIBCMT ref: 004DCF48
_free.LIBCMT ref: 004DCF71
_free.LIBCMT ref: 004DCFA9
_free.LIBCMT ref: 004DCFDA
_free.LIBCMT ref: 004DD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 004DD09C
_free.LIBCMT ref: 004DD0B5

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 1708e042d3224c386fe1116cc0080ef15b318fd34472d78de025ac4ad2e63934
Instruction ID: a67350e8c8420b83ae1edd916e9c90c6e018d2dc74c757be51889aa31477b5cd
Opcode Fuzzy Hash: 1708e042d3224c386fe1116cc0080ef15b318fd34472d78de025ac4ad2e63934
Instruction Fuzzy Hash: 8C6168B1A04302AFCF21AFB598F1AAA7BE5AF11314F04416FF904973C1D67D9901E798

Function 005350D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00535186
ShowWindow.USER32(?,00000000), ref: 005351C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 005351CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 005351D1

Part of subcall function 00536FBA: DeleteObject.GDI32(00000000), ref: 00536FE6

GetWindowLongW.USER32(?,000000F0), ref: 0053520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0053521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0053524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00535287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00535296

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 0661b2b6bc0f6705b4ac2366f6335fa67d57c2eec3b84738bc1a0f03d9daf10a
Instruction ID: 8fd4a6083a8b684ee9c42344afee2de14dcc8117feec73f76a9a9298d079a3c3
Opcode Fuzzy Hash: 0661b2b6bc0f6705b4ac2366f6335fa67d57c2eec3b84738bc1a0f03d9daf10a
Instruction Fuzzy Hash: 9751E334A40A09FFEF209F24CC4AFD93F65FB05324F145406FA559A2E0E775A994EB40

Function 004B8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 004F6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 004F68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 004F68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 004F68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 004F68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,004B8874,00000000,00000000,00000000,000000FF,00000000), ref: 004F6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 004F691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,004B8874,00000000,00000000,00000000,000000FF,00000000), ref: 004F692D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: aab401b99ecdfbc8b59246b07b439c3b1a4b51ebafd047df49581a566e155838
Instruction ID: af5eeb787671d6ceb97121080c32a31e8002bf53141076c4c3faa6b210e9570d
Opcode Fuzzy Hash: aab401b99ecdfbc8b59246b07b439c3b1a4b51ebafd047df49581a566e155838
Instruction Fuzzy Hash: C0519C70600209EFDB20CF29CC55FAA7BB5FB54750F10451EFA06972A0DB74E991EB54

Function 0051C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0051C182
GetLastError.KERNEL32 ref: 0051C195
SetEvent.KERNEL32(?), ref: 0051C1A9

Part of subcall function 0051C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0051C272
Part of subcall function 0051C253: GetLastError.KERNEL32 ref: 0051C322
Part of subcall function 0051C253: SetEvent.KERNEL32(?), ref: 0051C336
Part of subcall function 0051C253: InternetCloseHandle.WININET(00000000), ref: 0051C341

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: b66874c049b0ff3906e5e5a522b1487335d6b6ec1ed79b0f990fa04261ab999c
Instruction ID: bd9e7170adf2dd780ef4c1e66e1516b0b90d8a536f64603639282b41f4745cce
Opcode Fuzzy Hash: b66874c049b0ff3906e5e5a522b1487335d6b6ec1ed79b0f990fa04261ab999c
Instruction Fuzzy Hash: 36318375180601BFEB219FA5DC48AA7BFF9FF58300B00441DF9A692610D732E854EB60

Function 005025A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00503A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00503A57
Part of subcall function 00503A3D: GetCurrentThreadId.KERNEL32 ref: 00503A5E
Part of subcall function 00503A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,005025B3), ref: 00503A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 005025BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 005025DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 005025DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 005025E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00502601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00502605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0050260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00502623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00502627

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: e9006b6b671b6085e0684e2ce75ea5a230e2e7d5130f704a5a6ba021f2121469
Instruction ID: 0369d625b3db8b363a0401e5992c3b4351bf018e670e54816b762e59f1c85476
Opcode Fuzzy Hash: e9006b6b671b6085e0684e2ce75ea5a230e2e7d5130f704a5a6ba021f2121469
Instruction Fuzzy Hash: 3F01D431390210BBFB2067699C8EF593F59EB9EB12F100001F318BE1D1C9E22448EA69

Function 00501803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00501449,?,?,00000000), ref: 0050180C
HeapAlloc.KERNEL32(00000000,?,00501449,?,?,00000000), ref: 00501813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00501449,?,?,00000000), ref: 00501828
GetCurrentProcess.KERNEL32(?,00000000,?,00501449,?,?,00000000), ref: 00501830
DuplicateHandle.KERNEL32(00000000,?,00501449,?,?,00000000), ref: 00501833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00501449,?,?,00000000), ref: 00501843
GetCurrentProcess.KERNEL32(00501449,00000000,?,00501449,?,?,00000000), ref: 0050184B
DuplicateHandle.KERNEL32(00000000,?,00501449,?,?,00000000), ref: 0050184E
CreateThread.KERNEL32(00000000,00000000,00501874,00000000,00000000,00000000), ref: 00501868

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 3e50f988b01720766be7958efbcb5f561cf5fc7a950d3d59025ed128106d92c9
Instruction ID: c347d7cc2cdb32241bb72a316e1c8df5da4a9df7e4dc3ecf0f854b888f0084c5
Opcode Fuzzy Hash: 3e50f988b01720766be7958efbcb5f561cf5fc7a950d3d59025ed128106d92c9
Instruction Fuzzy Hash: 3801BF75240304BFE710AB65DC4DF5B3F6CEB99B11F004411FA05EB291C670D814EB20

Function 004D3E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004D3F0B
__alldvrm.LIBCMT ref: 004D410C
__alldvrm.LIBCMT ref: 004D412E

Strings

}}L, xrefs: 004D3E8A
}}L, xrefs: 004D40CD
}}L, xrefs: 004D3E96, 004D3EF1, 004D3F0A, 004D4090

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}L$}}L$}}L
API String ID: 1036877536-698281817
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 45e2ebb1f3e86e47970723f64a45e89d175963d9c517ccd4b629eb0f1a41b68a
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 21A13771E003869FDB26CF18C8A1BAEBBE5EFA1354F18416FE5859B381C23C9941C759

Function 0052A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0050D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0050D501
Part of subcall function 0050D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0050D50F
Part of subcall function 0050D4DC: CloseHandle.KERNEL32(00000000), ref: 0050D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0052A16D
GetLastError.KERNEL32 ref: 0052A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0052A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0052A268
GetLastError.KERNEL32(00000000), ref: 0052A273
CloseHandle.KERNEL32(00000000), ref: 0052A2C4

Strings

SeDebugPrivilege, xrefs: 0052A18F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: b41d01bc1184a27146f0a8182203322a71b6b964c684da1c3310315654b7d1f0
Instruction ID: c46ceca008f41735e16bc2295b1155ddad256d18493958b66f3968418ec670d0
Opcode Fuzzy Hash: b41d01bc1184a27146f0a8182203322a71b6b964c684da1c3310315654b7d1f0
Instruction Fuzzy Hash: 33619A342042529FD720DF19D494F19BFA1BF56318F18848CE4668B7E2C776EC49CB92

Function 00533886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00533925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0053393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00533954
_wcslen.LIBCMT ref: 00533999
SendMessageW.USER32(?,00001057,00000000,?), ref: 005339C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 005339F4

Strings

SysListView32, xrefs: 005338F7

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 0f73debd1cf6983e05f131e5e68cb3ef61bc9d420e91137cbf6ebcd0584bf2e8
Instruction ID: e01c94bf06051c8e98a14293840a015b2a37fdace60d8f12bff47923f67797cb
Opcode Fuzzy Hash: 0f73debd1cf6983e05f131e5e68cb3ef61bc9d420e91137cbf6ebcd0584bf2e8
Instruction Fuzzy Hash: 0A41C271A00219ABEB219F64CC49FEA7FA9FF08354F10052AF958E7281D7719E84CB90

Function 0050BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0050BCFD
IsMenu.USER32(00000000), ref: 0050BD1D
CreatePopupMenu.USER32 ref: 0050BD53
GetMenuItemCount.USER32(00A679C0), ref: 0050BDA4
InsertMenuItemW.USER32(00A679C0,?,00000001,00000030), ref: 0050BDCC

Strings

2, xrefs: 0050BD37
0, xrefs: 0050BCA8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 522828f38477c6d1137253b49408a5b55ed91eb761f4fe8925999547680ca399
Instruction ID: c6aa574b8e378174c94ebba8f0b19f2928733f45e7d1cc1478c64f052a00a7d6
Opcode Fuzzy Hash: 522828f38477c6d1137253b49408a5b55ed91eb761f4fe8925999547680ca399
Instruction Fuzzy Hash: 84519C72A002069BEB20DFA8D8C9BAEFFF4BF95314F148619E811A72D1D7709944CB61

Function 004C2D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004C2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 004C2D53
_ValidateLocalCookies.LIBCMT ref: 004C2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 004C2E0C
_ValidateLocalCookies.LIBCMT ref: 004C2E61

Strings

csm, xrefs: 004C2DF6
&HL, xrefs: 004C2DFE, 004C2E07, 004C2E18

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &HL$csm
API String ID: 1170836740-204362301
Opcode ID: e79af5f953c96cba593554029b04014fce97676312b7b6830ad85a42cad882e0
Instruction ID: e5de45abd4c67a6e52d85b62cd27078a3c1682c5ebbd1410930c3a6a12b93a06
Opcode Fuzzy Hash: e79af5f953c96cba593554029b04014fce97676312b7b6830ad85a42cad882e0
Instruction Fuzzy Hash: 7041E438A00208ABCF50DF69C944F9EBBA0BF54328F14805EE8156B392D7B99A05CB95

Function 0050C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0050C913

Strings

info, xrefs: 0050C8B4
warning, xrefs: 0050C8FC
blank, xrefs: 0050C895
question, xrefs: 0050C8CC
stop, xrefs: 0050C8E4

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 8569ff7fdda9c162694d1334ad2b4032237d774a281a99de4f491b2d2dddc78e
Instruction ID: 64cfdc3222c8538ee9501138647e36455518966c890de5e7577bce111af8993e
Opcode Fuzzy Hash: 8569ff7fdda9c162694d1334ad2b4032237d774a281a99de4f491b2d2dddc78e
Instruction Fuzzy Hash: 0C112B35789306BAE7145B549C83DAE2F9CFF16718B10452FF904A62C2D7756D005268

Function 0050DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0050DE42
gethostname.WSOCK32(?,00000100), ref: 0050DE5C
gethostbyname.WSOCK32(?), ref: 0050DE69
inet_ntoa.WSOCK32(?), ref: 0050DEAB
_strcat.LIBCMT ref: 0050DEB9
WSACleanup.WSOCK32 ref: 0050DEDE

Strings

0.0.0.0, xrefs: 0050DE87

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 858940a9a33c46f3a7408f053a5b0e3f2e48d9f6f2349af47122e6cd9665b96a
Instruction ID: 5424abf103051137763f4630d036fe55d3d353c1337bca14dae16f7949600018
Opcode Fuzzy Hash: 858940a9a33c46f3a7408f053a5b0e3f2e48d9f6f2349af47122e6cd9665b96a
Instruction Fuzzy Hash: 4911E472904114ABCB20AB71DC0AEEE7FBCEB60714F00016EF405AA1D1EF758A859B70

Function 0050ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0050ED2A
_wcslen.LIBCMT ref: 0050ED3B
_wcslen.LIBCMT ref: 0050ED79
_wcslen.LIBCMT ref: 0050EDAF
_wcslen.LIBCMT ref: 0050EDDF
_wcslen.LIBCMT ref: 0050EDEF
_wcslen.LIBCMT ref: 0050EE2B
_wcslen.LIBCMT ref: 0050EE5A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: df298b16b397ca4564c617b94f00f39a0ff27ba5aaf437e9f367bf1cee4b98ad
Instruction ID: c66dd4ced25a34aeba981d2ccde7b7d527e1a4f094536d2c11d71c5c927083f0
Opcode Fuzzy Hash: df298b16b397ca4564c617b94f00f39a0ff27ba5aaf437e9f367bf1cee4b98ad
Instruction Fuzzy Hash: 47419369C1011865CB91EBB5C88AECFB7ACAF45310F50886FE518E3162EB38D245C3A9

Function 004BF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,004F682C,00000004,00000000,00000000), ref: 004BF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,004F682C,00000004,00000000,00000000), ref: 004FF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,004F682C,00000004,00000000,00000000), ref: 004FF454

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: ff00ed9216d6caf96b7d52bd08b6986f4b8b6aa8a0a25064211b88bbfddf7532
Instruction ID: bda7b29af9020bac1db77a6d7b17d176e754b74b09647ebfc5816ecf8629a233
Opcode Fuzzy Hash: ff00ed9216d6caf96b7d52bd08b6986f4b8b6aa8a0a25064211b88bbfddf7532
Instruction Fuzzy Hash: 6A410671208640BBC7398B2D8C887BB7B91AF66314F14443FE54F52760C639A88DEB39

Function 00532D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00532D1B
GetDC.USER32(00000000), ref: 00532D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00532D2E
ReleaseDC.USER32(00000000,00000000), ref: 00532D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00532D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00532D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00535A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00532DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00532DE1

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 58fc187f2e1e10a4b79771ba5f2f9a7932a5f7437bf184760f2ea8387b53c2d4
Instruction ID: 56948cb2f33106d36961fb25b1cdbc4de73f404875131977458c282f101f6b3a
Opcode Fuzzy Hash: 58fc187f2e1e10a4b79771ba5f2f9a7932a5f7437bf184760f2ea8387b53c2d4
Instruction Fuzzy Hash: 77318B72201614BBEB218F54CC8AFEB3FA9FB19711F044055FE08AA291C6759C41CBA0

Function 00505622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00505637
_memcmp.LIBVCRUNTIME ref: 00505659
_memcmp.LIBVCRUNTIME ref: 00505671
_memcmp.LIBVCRUNTIME ref: 00505684
_memcmp.LIBVCRUNTIME ref: 0050569E
_memcmp.LIBVCRUNTIME ref: 005056B1
_memcmp.LIBVCRUNTIME ref: 005056C9
_memcmp.LIBVCRUNTIME ref: 005056E4

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: c0d17c94fa954ab6c99d2e93462f3c229d59f6dbc57fb3398aafaa9e9320e2bf
Instruction ID: e302e2a00707379f783dc0517618a26e9671cfb1e44c7bbcd224a5233de74dd5
Opcode Fuzzy Hash: c0d17c94fa954ab6c99d2e93462f3c229d59f6dbc57fb3398aafaa9e9320e2bf
Instruction Fuzzy Hash: 5521FC75A84A09B7E31455118E92FFF3B5CBF21388F440029FD059A9D2F726ED108EE9

Function 00524FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0052502E, 00525383
Not an Object type, xrefs: 00525007

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: bcc06abe27a6b3478e747a512736daf6108b1821d22053699655a16ea636ce5b
Instruction ID: 0688a7194a370b99bba6880733715db70e03c71921b5e9a6530845738403737d
Opcode Fuzzy Hash: bcc06abe27a6b3478e747a512736daf6108b1821d22053699655a16ea636ce5b
Instruction Fuzzy Hash: 1FD1D175A0061A9FDF10CFA8D884BAEBBB5FF49304F148469E915AB2C1E770DD45CB90

Function 004E1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 004E15CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 004E1651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004E16E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 004E16FB

Part of subcall function 004D3820: RtlAllocateHeap.NTDLL(00000000,?,00571444,?,004BFDF5,?,?,004AA976,00000010,00571440,004A13FC,?,004A13C6,?,004A1129), ref: 004D3852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004E1777
__freea.LIBCMT ref: 004E17A2
__freea.LIBCMT ref: 004E17AE

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: e2dbd849d4edfeaae71788f4c72f46eaeb7bc26454dc2b700b9265ba311413e3
Instruction ID: f78ca52211735c17b8af8e01ad20bd52b7139d773714c70331236836c2c110f4
Opcode Fuzzy Hash: e2dbd849d4edfeaae71788f4c72f46eaeb7bc26454dc2b700b9265ba311413e3
Instruction Fuzzy Hash: 3D91C371E40286ABDB208E76C881EEF7BB5AF45711F18465BE801E7261D73DCC40C768

Function 00524523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00524648
VariantInit.OLEAUT32(?), ref: 00524749
VariantClear.OLEAUT32(?), ref: 00524753
VariantClear.OLEAUT32(?), ref: 005247B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0052472C
Null Object assignment in FOR..IN loop, xrefs: 005245D8, 00524706, 005247BE

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 305feae75abcefd90548f50b1e0a66b9573666ee4d707c39a63fb08c94e89ad3
Instruction ID: 8fae26793ddcec0fd658152c129f6c52c41f3108e1976e3ad6ed76b57513a402
Opcode Fuzzy Hash: 305feae75abcefd90548f50b1e0a66b9573666ee4d707c39a63fb08c94e89ad3
Instruction Fuzzy Hash: AC91A071A00229ABDF20CFA5D884FAEBFB8FF46714F148559F515AB280D7709945CFA0

Function 00511187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0051125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00511284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 005112A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 005112D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0051135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 005113C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00511430

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 8cb84c989211232fe085573de223cd80f705a8af113c33db17186fdb3a5bcbde
Instruction ID: 6cea0085d782b3c25bfecfedeecf4cf54c586c7efbad6b6c2dd4f287f61fa802
Opcode Fuzzy Hash: 8cb84c989211232fe085573de223cd80f705a8af113c33db17186fdb3a5bcbde
Instruction Fuzzy Hash: 50916675A00609AFEB00CF95C884BFEBBB4FF44715F104469E610EB291D7B8AC81CB98

Function 004B948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: dcb37ff8cc666905162b39ae285f94c0e4c3e5eff9a82591018345d265f54c51
Instruction ID: 4be17b3f7f9053c0195041085199e185a0efad5771149d887f185d3a8b17537b
Opcode Fuzzy Hash: dcb37ff8cc666905162b39ae285f94c0e4c3e5eff9a82591018345d265f54c51
Instruction Fuzzy Hash: 61912671944219AFCB14CFA9CC84AEEBBB8FF49320F14405AE615B7251D378AD42CB64

Function 00523947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0052396B
CharUpperBuffW.USER32(?,?), ref: 00523A7A
_wcslen.LIBCMT ref: 00523A8A
VariantClear.OLEAUT32(?), ref: 00523C1F

Part of subcall function 00510CDF: VariantInit.OLEAUT32(00000000), ref: 00510D1F
Part of subcall function 00510CDF: VariantCopy.OLEAUT32(?,?), ref: 00510D28
Part of subcall function 00510CDF: VariantClear.OLEAUT32(?), ref: 00510D34

Strings

AUTOIT.ERROR, xrefs: 00523A80, 00523A85
Incorrect Parameter format, xrefs: 005239A6, 00523BA1

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 81a3bf4b49f40750fe6892c31086100b55d3d36bc58666ecc7db5130f005bac7
Instruction ID: 65ebaab4bf2a8786c4df6b58acf335fd5cb341628f8fa8bd1ca7e2a2b423adeb
Opcode Fuzzy Hash: 81a3bf4b49f40750fe6892c31086100b55d3d36bc58666ecc7db5130f005bac7
Instruction Fuzzy Hash: 9C916A756083159FC704EF24D48496ABBE4FF8A318F04882EF88997391DB34EE45CB92

Function 00524BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0050000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,004FFF41,80070057,?,?,?,0050035E), ref: 0050002B
Part of subcall function 0050000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004FFF41,80070057,?,?), ref: 00500046
Part of subcall function 0050000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004FFF41,80070057,?,?), ref: 00500054
Part of subcall function 0050000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004FFF41,80070057,?), ref: 00500064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00524C51
_wcslen.LIBCMT ref: 00524D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00524DCF
CoTaskMemFree.OLE32(?), ref: 00524DDA

Strings

NULL Pointer assignment, xrefs: 00524E23, 00524E52

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 5b6b704ee54d551c3a247099b4e2d9049556a3aed1bf774a50221cbd2c27cbc8
Instruction ID: d9fab96c3873e69806cda95c5c4861bf25b4415e603d90ef23816ae59b83a78f
Opcode Fuzzy Hash: 5b6b704ee54d551c3a247099b4e2d9049556a3aed1bf774a50221cbd2c27cbc8
Instruction Fuzzy Hash: AD912771D00229AFDF14DFA4D891AEEBBB8BF09304F10856AE915B7291DB349E44CF61

Function 005320FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00532183
GetMenuItemCount.USER32(00000000), ref: 005321B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 005321DD
_wcslen.LIBCMT ref: 00532213
GetMenuItemID.USER32(?,?), ref: 0053224D
GetSubMenu.USER32(?,?), ref: 0053225B

Part of subcall function 00503A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00503A57
Part of subcall function 00503A3D: GetCurrentThreadId.KERNEL32 ref: 00503A5E
Part of subcall function 00503A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,005025B3), ref: 00503A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 005322E3

Part of subcall function 0050E97B: Sleep.KERNELBASE ref: 0050E9F3

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: e0fba8e346e6d35ef99477f1ae100668cf7c5c2365be1bca6837b5e6ca7f89f4
Instruction ID: 0e61dd6cc19934d9cd9c3001db966036aaeb3cf2aa5c406924b252501e1d1726
Opcode Fuzzy Hash: e0fba8e346e6d35ef99477f1ae100668cf7c5c2365be1bca6837b5e6ca7f89f4
Instruction Fuzzy Hash: 0B717C75A00605AFCB10EF69C885AAEBBF5BF88314F148459F816EB351DB34ED41CBA0

Function 00537E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00A677B8), ref: 00537F37
IsWindowEnabled.USER32(00A677B8), ref: 00537F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0053801E
SendMessageW.USER32(00A677B8,000000B0,?,?), ref: 00538051
IsDlgButtonChecked.USER32(?,?), ref: 00538089
GetWindowLongW.USER32(00A677B8,000000EC), ref: 005380AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 005380C3

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: cc52ec9d8629984db0711cec9b1b5fd79ecaf195476e2f8dc226fc4083586830
Instruction ID: 03a62eac372d55eb199e29111611fbf515d9c5721b3d089968b298ab943b45de
Opcode Fuzzy Hash: cc52ec9d8629984db0711cec9b1b5fd79ecaf195476e2f8dc226fc4083586830
Instruction Fuzzy Hash: F771ADB4A08648AFEB359F64C884FBABFB5FF1D300F144459F95597261CB31A845DB20

Function 0050AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0050AEF9
GetKeyboardState.USER32(?), ref: 0050AF0E
SetKeyboardState.USER32(?), ref: 0050AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0050AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0050AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0050AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0050B020

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 08db6af13de9a07aeac161d97725393bb0583ea46bb62701dbee1b27669d2500
Instruction ID: 66377ffa68d4fe07e9e2df9913a59bd7f1dbb435d78ad9b710f9f418818a7c5d
Opcode Fuzzy Hash: 08db6af13de9a07aeac161d97725393bb0583ea46bb62701dbee1b27669d2500
Instruction Fuzzy Hash: 3151A3A0A047D63DFB368334CC99BBE7EA97B06304F088589E1D9954C3D399ACC8D751

Function 0050ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0050AD19
GetKeyboardState.USER32(?), ref: 0050AD2E
SetKeyboardState.USER32(?), ref: 0050AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0050ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0050ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0050AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0050AE38

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d0d9b673dad273d20eb580058d018dfbefb274341f5ac6b1015524f105c4bd05
Instruction ID: 62ef93b7f5397c95daf814478048a159b703774aa8049481c5a1314e20e0e818
Opcode Fuzzy Hash: d0d9b673dad273d20eb580058d018dfbefb274341f5ac6b1015524f105c4bd05
Instruction Fuzzy Hash: FA51B5A15047D63DFB378334CC95BBEBEA97B46300F088589E1D55A8C3D294EC88E762

Function 004D542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(004E3CD6,?,?,?,?,?,?,?,?,004D5BA3,?,?,004E3CD6,?,?), ref: 004D5470
__fassign.LIBCMT ref: 004D54EB
__fassign.LIBCMT ref: 004D5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,004E3CD6,00000005,00000000,00000000), ref: 004D552C
WriteFile.KERNEL32(?,004E3CD6,00000000,004D5BA3,00000000,?,?,?,?,?,?,?,?,?,004D5BA3,?), ref: 004D554B
WriteFile.KERNEL32(?,?,00000001,004D5BA3,00000000,?,?,?,?,?,?,?,?,?,004D5BA3,?), ref: 004D5584

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 4aaa1b719c979d1a56f636009fdb95899d2eacb92cc2e60563047e0a30d690df
Instruction ID: 7d4d2e0fa818dc03efb9ebf3e2169d47b55fc24be54fc085d17718bd394f5eea
Opcode Fuzzy Hash: 4aaa1b719c979d1a56f636009fdb95899d2eacb92cc2e60563047e0a30d690df
Instruction Fuzzy Hash: BB51E3B0A00648AFCB11CFA8E861AEEBBF9EF19300F14411BF555E3391DB349A41CB65

Function 005210B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0052304E: inet_addr.WSOCK32(?), ref: 0052307A
Part of subcall function 0052304E: _wcslen.LIBCMT ref: 0052309B

socket.WSOCK32(00000002,00000001,00000006), ref: 00521112
WSAGetLastError.WSOCK32 ref: 00521121
WSAGetLastError.WSOCK32 ref: 005211C9
closesocket.WSOCK32(00000000), ref: 005211F9

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 91e2538f9b58c729da3d4e6b0e87a1cec482888be99abe75a8b0808fca9741d1
Instruction ID: f7bb899751636e4b39b5023855624cab7311e26a5036e1f5f57ca8f8286cd687
Opcode Fuzzy Hash: 91e2538f9b58c729da3d4e6b0e87a1cec482888be99abe75a8b0808fca9741d1
Instruction Fuzzy Hash: CE411431600614AFDB109F24D884BAABFE9FF56328F148059FD06AB2D1C774AE45CBE5

Function 0050CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0050DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0050CF22,?), ref: 0050DDFD

Part of subcall function 0050DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0050CF22,?), ref: 0050DE16

lstrcmpiW.KERNEL32(?,?), ref: 0050CF45
MoveFileW.KERNEL32(?,?), ref: 0050CF7F
_wcslen.LIBCMT ref: 0050D005
_wcslen.LIBCMT ref: 0050D01B
SHFileOperationW.SHELL32(?), ref: 0050D061

Strings

\*.*, xrefs: 0050CFF3

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 1765aefd31166b6611fe29053aac004007bc6ca989b83e8fb11c80cc2528f39c
Instruction ID: 425506546c30724c6ab84d0e0b510d3dada727dd2f6d3bb1e3efc3e767b718c1
Opcode Fuzzy Hash: 1765aefd31166b6611fe29053aac004007bc6ca989b83e8fb11c80cc2528f39c
Instruction Fuzzy Hash: 034189B18052195FDF12EFA4C985EDE7FB8BF55380F1000EAE505E7181EB34AA48CB51

Function 00532DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00532E1C
GetWindowLongW.USER32(?,000000F0), ref: 00532E4F
GetWindowLongW.USER32(?,000000F0), ref: 00532E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00532EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00532EE0
GetWindowLongW.USER32(?,000000F0), ref: 00532EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00532F0B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 58274c385c2242985ee28ab8e9d1cd9f0908aa216a59ba29e1dc8f4576f1baba
Instruction ID: 69520e05874e8c8c3ebc23714faa3237e702d90b2365e93a406fb1819ddc2be2
Opcode Fuzzy Hash: 58274c385c2242985ee28ab8e9d1cd9f0908aa216a59ba29e1dc8f4576f1baba
Instruction Fuzzy Hash: AA310335604650AFDB21CF5CEC86F653BE9FBAAB10F150164FA049F2B1CB71A885EB41

Function 00507726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00507769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0050778F
SysAllocString.OLEAUT32(00000000), ref: 00507792
SysAllocString.OLEAUT32(?), ref: 005077B0
SysFreeString.OLEAUT32(?), ref: 005077B9
StringFromGUID2.OLE32(?,?,00000028), ref: 005077DE
SysAllocString.OLEAUT32(?), ref: 005077EC

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 12a95bea3209d30ddda9758cb56938fc015c7a6d0befdee2a338033223cb3ef5
Instruction ID: 2d2419ed09881428ff6381362f081df0169d9f5d019fcaaa5043de8c18ea5170
Opcode Fuzzy Hash: 12a95bea3209d30ddda9758cb56938fc015c7a6d0befdee2a338033223cb3ef5
Instruction Fuzzy Hash: 2B21AE76A0421DAFDF10DFA8CC88CBF7BACFB093A47008425BA14DB290D670EC459764

Function 005077FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00507842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00507868
SysAllocString.OLEAUT32(00000000), ref: 0050786B
SysAllocString.OLEAUT32 ref: 0050788C
SysFreeString.OLEAUT32 ref: 00507895
StringFromGUID2.OLE32(?,?,00000028), ref: 005078AF
SysAllocString.OLEAUT32(?), ref: 005078BD

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: afdeb75af2ccad8996c7851a65e5afbc1b208932caf4b7605f9cb295f053851f
Instruction ID: 9d65756c49aae788843515106ab39ee19a35db24ca25b71ca8de86827d048e63
Opcode Fuzzy Hash: afdeb75af2ccad8996c7851a65e5afbc1b208932caf4b7605f9cb295f053851f
Instruction Fuzzy Hash: 7D215E32A08208AFDF109BA8DC88DAA7BACFF0D7607148125B915DB2A1D674EC55DB64

Function 005104D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 005104F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0051052E

Strings

nul, xrefs: 00510567

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: deb81584a10af77fbaf9665f9c583cf04dc155cad446e80597bc0300b4bac9ed
Instruction ID: 2486fbbb4cb96339e28c42a2c666aecf40daf6aa3b2830f1cebf4acc4f5df05e
Opcode Fuzzy Hash: deb81584a10af77fbaf9665f9c583cf04dc155cad446e80597bc0300b4bac9ed
Instruction Fuzzy Hash: C7217C75500305ABEF209F29D844AAA7FA5BF54724F204A19F8A1E62E0D7B099D4DF20

Function 005105A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 005105C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00510601

Strings

nul, xrefs: 00510639

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 77f2fdb05b9a728862bd4b85ce51626169f8a2d99c1433a9216172caaa61345c
Instruction ID: 3baca586e07900e1ddc81f3ae6ad1813e0d5a2af5a97d461229a90553d5a5c54
Opcode Fuzzy Hash: 77f2fdb05b9a728862bd4b85ce51626169f8a2d99c1433a9216172caaa61345c
Instruction Fuzzy Hash: 142165755003059BEB209F69DC44AEA7FE4BF95720F205A19F8A1E72D0D7F099E0DB50

Function 005340AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 004A604C
Part of subcall function 004A600E: GetStockObject.GDI32(00000011), ref: 004A6060
Part of subcall function 004A600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 004A606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00534112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0053411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0053412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00534139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00534145

Strings

Msctls_Progress32, xrefs: 005340E3

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: f0838e0099e5ca163386a33365488240af590d6a57fb482f9d7a45277d504e81
Instruction ID: d310d0aa557236edfe9739e6fb7121c8bfbecc0510618c81a0ff6b36587ab6f4
Opcode Fuzzy Hash: f0838e0099e5ca163386a33365488240af590d6a57fb482f9d7a45277d504e81
Instruction Fuzzy Hash: 0411B2B214021DBEEF118F64CC86EE77F5DFF18798F014111FA18A6150CA729C61DBA4

Function 004DD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004DD7A3: _free.LIBCMT ref: 004DD7CC

_free.LIBCMT ref: 004DD82D

Part of subcall function 004D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,004DD7D1,00000000,00000000,00000000,00000000,?,004DD7F8,00000000,00000007,00000000,?,004DDBF5,00000000), ref: 004D29DE
Part of subcall function 004D29C8: GetLastError.KERNEL32(00000000,?,004DD7D1,00000000,00000000,00000000,00000000,?,004DD7F8,00000000,00000007,00000000,?,004DDBF5,00000000,00000000), ref: 004D29F0

_free.LIBCMT ref: 004DD838
_free.LIBCMT ref: 004DD843
_free.LIBCMT ref: 004DD897
_free.LIBCMT ref: 004DD8A2
_free.LIBCMT ref: 004DD8AD
_free.LIBCMT ref: 004DD8B8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: e28b1b8014b55cfbe98980bfb0d8cc91044ae864a863bd9cb6d35fc2ac4bd29c
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: F41151B1A40B04AAD521BFB2CC67FCB7BDC6F10704F40086FF29DA6292DA6DB5055654

Function 0050DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0050DA74
LoadStringW.USER32(00000000), ref: 0050DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0050DA91
LoadStringW.USER32(00000000), ref: 0050DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0050DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0050DAB9

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: abe2a43db59da85c9f1d33f90e73d8a5f8c90eab0b63542c55a868d2ecb4f66b
Instruction ID: 125bb34235719f2a3180b40571d1925c58a52aea03cb7c9e503042da46b83c3e
Opcode Fuzzy Hash: abe2a43db59da85c9f1d33f90e73d8a5f8c90eab0b63542c55a868d2ecb4f66b
Instruction Fuzzy Hash: 340186F25002087FEB109BE49D89EEB3B6CF708301F400495B706F2181EA749E889F74

Function 0051096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00A62808,00A62808), ref: 0051097B
EnterCriticalSection.KERNEL32(00A627E8,00000000), ref: 0051098D
TerminateThread.KERNEL32(?,000001F6), ref: 0051099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 005109A9
CloseHandle.KERNEL32(?), ref: 005109B8
InterlockedExchange.KERNEL32(00A62808,000001F6), ref: 005109C8
LeaveCriticalSection.KERNEL32(00A627E8), ref: 005109CF

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: bd77290145bbac2cf247566f2fa43bc66a455d007adbe5b93a5b67efa85ff292
Instruction ID: 8e87f87b8df96f9b2bb83f9db7a0320a1a91f0e30291802fe2c34dfcb4fbb67e
Opcode Fuzzy Hash: bd77290145bbac2cf247566f2fa43bc66a455d007adbe5b93a5b67efa85ff292
Instruction Fuzzy Hash: D5F03131442502BBE7415F94EE8CBD67F35FF15702F402015F141A19A1C7B494B9DF90

Function 004A5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004A5D30
GetWindowRect.USER32(?,?), ref: 004A5D71
ScreenToClient.USER32(?,?), ref: 004A5D99
GetClientRect.USER32(?,?), ref: 004A5ED7
GetWindowRect.USER32(?,?), ref: 004A5EF8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 3beaa10a506be9bfc780f1abe02b3bce032b262fa9838aadf05c3bb678ab94af
Instruction ID: 8f4d22fe17fc375b5f8b9a137c0bd5c9fb8b1542742502c31f5bc26e2e26259e
Opcode Fuzzy Hash: 3beaa10a506be9bfc780f1abe02b3bce032b262fa9838aadf05c3bb678ab94af
Instruction Fuzzy Hash: 84B17A78A0068ADBDB10CFA9C5407EEB7F1FF68310F14841AE8A9D7250D738AA51DB59

Function 004D01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 004D00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004D00D6
__allrem.LIBCMT ref: 004D00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004D010B
__allrem.LIBCMT ref: 004D0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004D0140

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 2b6d903c312eaf3e5d3da0c8c358c7d367becd56103ee78a9fc4dbc10bdcce14
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 1181CF76A00706AAE7209A2ACC51B6B73A9EF41328F24413FF451D7781E77DD9048798

Function 00521D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00523149: select.WSOCK32(00000000,?,00000000,00000000,?), ref: 00523195

__WSAFDIsSet.WSOCK32(00000000,?), ref: 00521DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00521DE1
WSAGetLastError.WSOCK32 ref: 00521DF2
inet_ntoa.WSOCK32(?), ref: 00521E8C
htons.WSOCK32(?), ref: 00521EDB
_strlen.LIBCMT ref: 00521F35

Part of subcall function 005039E8: _strlen.LIBCMT ref: 005039F2

Part of subcall function 004A6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,004BCF58,?,?,?), ref: 004A6DBA
Part of subcall function 004A6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,004BCF58,?,?,?), ref: 004A6DED

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 8decda91e88110b0d8d4a5cf4e4d2b19d649875d4acbd1bc880ce164863bc4c3
Instruction ID: a1881ee7123d695916262f1a5c684424da4775a2829b9411877d0b618d390426
Opcode Fuzzy Hash: 8decda91e88110b0d8d4a5cf4e4d2b19d649875d4acbd1bc880ce164863bc4c3
Instruction Fuzzy Hash: 97A10F31104710AFC324EF21D885E2BBBA5BFA6308F54894DF4565B2E2CB35ED46CBA5

Function 004D61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,004C82D9,004C82D9,?,?,?,004D644F,00000001,00000001,8BE85006), ref: 004D6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,004D644F,00000001,00000001,8BE85006,?,?,?), ref: 004D62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 004D63D8
__freea.LIBCMT ref: 004D63E5

Part of subcall function 004D3820: RtlAllocateHeap.NTDLL(00000000,?,00571444,?,004BFDF5,?,?,004AA976,00000010,00571440,004A13FC,?,004A13C6,?,004A1129), ref: 004D3852

__freea.LIBCMT ref: 004D63EE
__freea.LIBCMT ref: 004D6413

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 24c93e0b845c25d3a536c84b8013510b46dfddc9c0ef67c98ea13e11069b5c43
Instruction ID: fe8f6d450db04c38050625b263e127ca57cc0f9014ba4aa835b47a6fc26a7d2b
Opcode Fuzzy Hash: 24c93e0b845c25d3a536c84b8013510b46dfddc9c0ef67c98ea13e11069b5c43
Instruction Fuzzy Hash: 0B511172600216ABDB259F64CCA1EAF7BA9EB44714F16422BFC05D6341DB3CDC44D668

Function 0052BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

Part of subcall function 0052C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0052B6AE,?,?), ref: 0052C9B5
Part of subcall function 0052C998: _wcslen.LIBCMT ref: 0052C9F1
Part of subcall function 0052C998: _wcslen.LIBCMT ref: 0052CA68
Part of subcall function 0052C998: _wcslen.LIBCMT ref: 0052CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0052BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0052BD25
RegCloseKey.ADVAPI32(00000000), ref: 0052BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0052BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0052BDF3
RegCloseKey.ADVAPI32(?), ref: 0052BDFF

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 8694fc0a725615505727c7a5c5e545390209a2d645522578c68c7ac2372ef216
Instruction ID: 11b1b5fee4b14fa1eb78299474b86b0a14b7ee4d33ec7ad44b93c9ba538204f0
Opcode Fuzzy Hash: 8694fc0a725615505727c7a5c5e545390209a2d645522578c68c7ac2372ef216
Instruction Fuzzy Hash: 4A81CF70208241EFD714DF24D885E6ABBE9FF86308F14895DF4598B2A2DB31ED45CB92

Function 004FF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 004FF7B9
SysAllocString.OLEAUT32(00000001), ref: 004FF860
VariantCopy.OLEAUT32(004FFA64,00000000), ref: 004FF889
VariantClear.OLEAUT32(004FFA64), ref: 004FF8AD
VariantCopy.OLEAUT32(004FFA64,00000000), ref: 004FF8B1
VariantClear.OLEAUT32(?), ref: 004FF8BB

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 631615028cd758aea7ce3a69fbd6795faf97644be144701ed0e0550dfa6566c0
Instruction ID: 451fa2a16f966aedafb0a923444de318e63366814b8e73ad85c0338ecb79abb4
Opcode Fuzzy Hash: 631615028cd758aea7ce3a69fbd6795faf97644be144701ed0e0550dfa6566c0
Instruction Fuzzy Hash: F5510B71500314BBCF10AB66D895B39B3A8EF55314F14446BEA05DF291D7B88C48D76F

Function 0051910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 004A7620: _wcslen.LIBCMT ref: 004A7625

Part of subcall function 004A6B57: _wcslen.LIBCMT ref: 004A6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 005194E5
_wcslen.LIBCMT ref: 00519506
_wcslen.LIBCMT ref: 0051952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00519585

Strings

X, xrefs: 00519412

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 8727ebab9887ed0c76fb3f9137f2a4d1cc13b99b67199181eca7439c6368bee0
Instruction ID: 21aef8f837d0cf5eba5125e888c5ca21d3718863743a4f96988d213af43ea8ff
Opcode Fuzzy Hash: 8727ebab9887ed0c76fb3f9137f2a4d1cc13b99b67199181eca7439c6368bee0
Instruction Fuzzy Hash: D7E1F5315043009FD724EF25C891AAEBBE1FF95318F04896DF8999B2A2DB34DD44CB96

Function 004B920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 004B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 004B9BB2

BeginPaint.USER32(?,?,?), ref: 004B9241
GetWindowRect.USER32(?,?), ref: 004B92A5
ScreenToClient.USER32(?,?), ref: 004B92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 004B92D3
EndPaint.USER32(?,?,?,?,?), ref: 004B9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 004F71EA

Part of subcall function 004B9339: BeginPath.GDI32(00000000), ref: 004B9357

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 0ac61421dcf54e5765d2524b2890fc90827ed6d93a70f85d618fe9e8cf5cc11f
Instruction ID: b6ceab3bd13764d0ca95ac27a1b1eaa4aa54929103adf13a08956c61228d6b06
Opcode Fuzzy Hash: 0ac61421dcf54e5765d2524b2890fc90827ed6d93a70f85d618fe9e8cf5cc11f
Instruction Fuzzy Hash: 3441A131104200AFD711DF28DC85FBA7BE8EB59324F14066AFA54972A1C7399C4AEB66

Function 005107EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0051080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00510847
EnterCriticalSection.KERNEL32(?), ref: 00510863
LeaveCriticalSection.KERNEL32(?), ref: 005108DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 005108F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00510921

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 66ce70ffee2819ffbca86f8e2b8c7096f8cb29566600b2a3015be91893a42638
Instruction ID: 6c10053987b33f00d0ea10007820e1011b065081284932fd8fa8ed5bfa7024ea
Opcode Fuzzy Hash: 66ce70ffee2819ffbca86f8e2b8c7096f8cb29566600b2a3015be91893a42638
Instruction Fuzzy Hash: 2641BC71900205EBEF04AF65DC81AAA7BB8FF04304F1040A9FD04AB297D774DEA4DBA4

Function 005381DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,004FF3AB,00000000,?,?,00000000,?,004F682C,00000004,00000000,00000000), ref: 0053824C
EnableWindow.USER32(?,00000000), ref: 00538272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 005382D1
ShowWindow.USER32(?,00000004), ref: 005382E5
EnableWindow.USER32(?,00000001), ref: 0053830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0053832F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: e42e9e655227e4e5b899f2a6037e804cbb173ff9531e1148314877275c9d2321
Instruction ID: f5486a9e81933a3ce49e7f9d2700da96a71bc30a40d7857fcf5ba379aa2e7b1f
Opcode Fuzzy Hash: e42e9e655227e4e5b899f2a6037e804cbb173ff9531e1148314877275c9d2321
Instruction Fuzzy Hash: 29419234601B44AFDB19CF19DC99BB57FE0FB5AB14F184169FA088F262CB31A845DB50

Function 00504C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00504C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00504CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00504CEA
_wcslen.LIBCMT ref: 00504D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00504D10
_wcsstr.LIBVCRUNTIME ref: 00504D1A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 061a0367884b884d899893452ddc07f333d8942ce699a8f4462c8e82aa43e4a2
Instruction ID: 63e0c4a92f6e19ea105362c9af7af9446f0901a773e8f04e06ab6279b1bac8d4
Opcode Fuzzy Hash: 061a0367884b884d899893452ddc07f333d8942ce699a8f4462c8e82aa43e4a2
Instruction Fuzzy Hash: D121D7B22042107BEB155B3A9C4AE7F7F9CEF55754F10402EF909DE191DA65DD009BA0

Function 0051581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 004A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,004A3A97,?,?,004A2E7F,?,?,?,00000000), ref: 004A3AC2

_wcslen.LIBCMT ref: 0051587B
CoInitialize.OLE32(00000000), ref: 00515995
CoCreateInstance.OLE32(0053FCF8,00000000,00000001,0053FB68,?), ref: 005159AE
CoUninitialize.OLE32 ref: 005159CC

Strings

.lnk, xrefs: 00515876, 005158C1, 00515985

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: e20bbe277e063b6dbb0bf08ba1f6c1421bda2f340e1dd76a038137ffb90c14e5
Instruction ID: 99d579a5f612682988d3b3808a13f2925813780e32db54138610dbddc2fe8fad
Opcode Fuzzy Hash: e20bbe277e063b6dbb0bf08ba1f6c1421bda2f340e1dd76a038137ffb90c14e5
Instruction Fuzzy Hash: 25D16574608601DFD714DF25C480A6ABBE1FF99714F14485EF88A9B361EB31EC85CB92

Function 0050175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00500FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00500FCA
Part of subcall function 00500FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00500FD6
Part of subcall function 00500FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00500FE5
Part of subcall function 00500FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00500FEC
Part of subcall function 00500FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00501002

GetLengthSid.ADVAPI32(?,00000000,00501335), ref: 005017AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 005017BA
HeapAlloc.KERNEL32(00000000), ref: 005017C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 005017DA
GetProcessHeap.KERNEL32(00000000,00000000,00501335), ref: 005017EE
HeapFree.KERNEL32(00000000), ref: 005017F5

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 8f4211489079c13443171fd8e52626668cef558011d5fe8963a6524f9039a8d5
Instruction ID: 52f6f79012f4b47ae4beac5ad0685e17e47ec814113dd0f4135a9a7fd66bc415
Opcode Fuzzy Hash: 8f4211489079c13443171fd8e52626668cef558011d5fe8963a6524f9039a8d5
Instruction Fuzzy Hash: B411BE32500605FFDB189FA4CC49BAE7FE9FB55355F104018F481E7290C735A944EB65

Function 005014CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 005014FF
OpenProcessToken.ADVAPI32(00000000), ref: 00501506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00501515
CloseHandle.KERNEL32(00000004), ref: 00501520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0050154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00501563

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 10b9e438c7b96f71a12c91d8bc029028e21241b9a61905dacb7a8d807d06e02f
Instruction ID: 0fb1d772bd8b4a7315d7b02b6729f04d26bea68ee72dbd3d1289dad4981ea19b
Opcode Fuzzy Hash: 10b9e438c7b96f71a12c91d8bc029028e21241b9a61905dacb7a8d807d06e02f
Instruction Fuzzy Hash: 4E112672500249ABDF118FA8DD49FDE7FA9FF48748F044029FA05A61A0C3758E68EB65

Function 004C3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004C3379,004C2FE5), ref: 004C3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004C339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004C33B7
SetLastError.KERNEL32(00000000,?,004C3379,004C2FE5), ref: 004C3409

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 77ecd46c30f02e9709eb50e5034637e9bc5a4996ee5bc11243a0fd5844eb17a3
Instruction ID: 6052f7df049d840bba22d679b4205c19b2f20de57d4edc1b6fe2c980c1d82348
Opcode Fuzzy Hash: 77ecd46c30f02e9709eb50e5034637e9bc5a4996ee5bc11243a0fd5844eb17a3
Instruction Fuzzy Hash: 4101D63A30C3116A96B42B797C95F6B2E54D72577F320822FF410812F1EE595D05614C

Function 004D2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004D5686,004E3CD6,?,00000000,?,004D5B6A,?,?,?,?,?,004CE6D1,?,00568A48), ref: 004D2D78
_free.LIBCMT ref: 004D2DAB
_free.LIBCMT ref: 004D2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,004CE6D1,?,00568A48,00000010,004A4F4A,?,?,00000000,004E3CD6), ref: 004D2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,004CE6D1,?,00568A48,00000010,004A4F4A,?,?,00000000,004E3CD6), ref: 004D2DEC
_abort.LIBCMT ref: 004D2DF2

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: acade5f77034f75de0ae2d032e43c1b1984633c86e4e006153642972ef95dcfa
Instruction ID: da680cd3318c88d04d051d91cb1643e89edd3b1a7bf77001cb3ad8cdc4673632
Opcode Fuzzy Hash: acade5f77034f75de0ae2d032e43c1b1984633c86e4e006153642972ef95dcfa
Instruction Fuzzy Hash: C2F0F93150460027C21227397E36A5B29566FF27A5F24041FF424D33D1EEFC88056229

Function 00538A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 004B9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 004B9693
Part of subcall function 004B9639: SelectObject.GDI32(?,00000000), ref: 004B96A2
Part of subcall function 004B9639: BeginPath.GDI32(?), ref: 004B96B9
Part of subcall function 004B9639: SelectObject.GDI32(?,00000000), ref: 004B96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00538A4E
LineTo.GDI32(?,00000003,00000000), ref: 00538A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00538A70
LineTo.GDI32(?,00000000,00000003), ref: 00538A80
EndPath.GDI32(?), ref: 00538A90
StrokePath.GDI32(?), ref: 00538AA0

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 2e218535d5b89c0085b6d220bc5309605f41f3a1739192afeb4aa1270cd056b4
Instruction ID: 22f56c85a3d699d8370805db229d8ee4adbbb26386bc2651e205e1ea325160dc
Opcode Fuzzy Hash: 2e218535d5b89c0085b6d220bc5309605f41f3a1739192afeb4aa1270cd056b4
Instruction Fuzzy Hash: 73111B7600014CFFDF129F94DC88EAA7F6CEB18354F008052BA19AA2A1C7719D59EFA0

Function 005051FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00505218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00505229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00505230
ReleaseDC.USER32(00000000,00000000), ref: 00505238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0050524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00505261

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: f440f46c0e3a36ca8d6c7bafe68b8ec4241594bda1234c515ce7ca5ce15d0e8d
Instruction ID: 8c7d648e11cf514f35eb97284484d9e43b6a93411e7514f0bc9f834c262d101a
Opcode Fuzzy Hash: f440f46c0e3a36ca8d6c7bafe68b8ec4241594bda1234c515ce7ca5ce15d0e8d
Instruction Fuzzy Hash: 5D014F75A00719BBEB109BE69C49A5EBFB8FF58751F044066FA04E7391D6709804DFA0

Function 004A1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 004A1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 004A1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 004A1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 004A1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 004A1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 004A1C22

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: a804534593292eed471e983bd71540bc2743bd25d39f01cb2693f9c0ceb5950c
Instruction ID: 004f9b85d94751e33f26da9cb4dc35a745f0ed582e025089701c29a316f1ad39
Opcode Fuzzy Hash: a804534593292eed471e983bd71540bc2743bd25d39f01cb2693f9c0ceb5950c
Instruction Fuzzy Hash: D4016CB09027597DE3008F5A8C85B52FFA8FF19354F00411B915C4BA41C7F5A864CBE5

Function 0050EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0050EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0050EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0050EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0050EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0050EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0050EB75

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 0a667eb9c0964a1d1f700b1a509d40e8c1e57cb83621af8fe2cf7ac3604ed58f
Instruction ID: c80b6dfa533636f0b71940d54d6c77e783fba5d87f7c07b1397d5221d9ca9d9b
Opcode Fuzzy Hash: 0a667eb9c0964a1d1f700b1a509d40e8c1e57cb83621af8fe2cf7ac3604ed58f
Instruction Fuzzy Hash: A7F05E72240158BBE7215B669C0EEEF3E7CEFDBB11F004158F601E5291D7A05A05E7B5

Function 004F7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 004F7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 004F7469
GetWindowDC.USER32(?), ref: 004F7475
GetPixel.GDI32(00000000,?,?), ref: 004F7484
ReleaseDC.USER32(?,00000000), ref: 004F7496
GetSysColor.USER32(00000005), ref: 004F74B0

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 64fb3e753cba368998079016fe64ad2f9582972409330c81b4289870d844dbb4
Instruction ID: 8d337cffaa8d3ba0a5b6c69ea427553ecfcf33aa9f7e8961f2ab0f6b4066fbc0
Opcode Fuzzy Hash: 64fb3e753cba368998079016fe64ad2f9582972409330c81b4289870d844dbb4
Instruction Fuzzy Hash: 4A018B31400609EFEB105FA8DC09BAA7FB5FB14311F1000A1FA16A22A0CB351E55FB11

Function 00501874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0050187F
UnloadUserProfile.USERENV(?,?), ref: 0050188B
CloseHandle.KERNEL32(?), ref: 00501894
CloseHandle.KERNEL32(?), ref: 0050189C
GetProcessHeap.KERNEL32(00000000,?), ref: 005018A5
HeapFree.KERNEL32(00000000), ref: 005018AC

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 0024ec10a5a33081d56148640608fc361862c80507b2cc8fa5906394fab8fa94
Instruction ID: 55d97d302e576f7da309f4398e8612e8c847ca7999c88780bb4264d84b014cc8
Opcode Fuzzy Hash: 0024ec10a5a33081d56148640608fc361862c80507b2cc8fa5906394fab8fa94
Instruction Fuzzy Hash: 3BE0E536004101BBDB015FA1ED0C90ABF39FF69B22B108624F225A1270CB329434FF50

Function 004ABBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004ABEB3

Strings

D%WD%W, xrefs: 004ABCA5
D%W, xrefs: 004ABDED, 004ABD91, 004ABD1B
D%W, xrefs: 004ABCA2
D%W, xrefs: 004ABE9A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%W$D%W$D%W$D%WD%W
API String ID: 1385522511-699628468
Opcode ID: 16d1aa515d3b19747ed008874ebc606ed7777837e44ebe451a9593bc31fd7b6b
Instruction ID: 58f9df65710f6ef76f991a450ea63a73206dfe6f3b18c8ead534578ad04a093c
Opcode Fuzzy Hash: 16d1aa515d3b19747ed008874ebc606ed7777837e44ebe451a9593bc31fd7b6b
Instruction Fuzzy Hash: 83914C75A00206CFCB14CF59C090AAAB7F1FF6A310F24816ED945AB352D739AD81DBD4

Function 00527B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 004C0242: EnterCriticalSection.KERNEL32(0057070C,00571884,?,?,004B198B,00572518,?,?,?,004A12F9,00000000), ref: 004C024D
Part of subcall function 004C0242: LeaveCriticalSection.KERNEL32(0057070C,?,004B198B,00572518,?,?,?,004A12F9,00000000), ref: 004C028A

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

Part of subcall function 004C00A3: __onexit.LIBCMT ref: 004C00A9

__Init_thread_footer.LIBCMT ref: 00527BFB

Part of subcall function 004C01F8: EnterCriticalSection.KERNEL32(0057070C,?,?,004B8747,00572514), ref: 004C0202
Part of subcall function 004C01F8: LeaveCriticalSection.KERNEL32(0057070C,?,004B8747,00572514), ref: 004C0235

Strings

G, xrefs: 00527C7F
5, xrefs: 00527C78
Variable must be of type 'Object'., xrefs: 00527C3A
+TO, xrefs: 00527E2E

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +TO$5$G$Variable must be of type 'Object'.
API String ID: 535116098-707387787
Opcode ID: 7d024454972bd4a9104d9d64e0f21dc6f0b89a30fdf2d23865136ba174df5143
Instruction ID: 261648412d77c21255f531d0f9582a334252d339e85d2ccf98fe82a2cdad4376
Opcode Fuzzy Hash: 7d024454972bd4a9104d9d64e0f21dc6f0b89a30fdf2d23865136ba174df5143
Instruction Fuzzy Hash: A891AB70A04219EFCB04EF94E894DADBBB1FF4A304F14845DF806AB292DB31AE41DB51

Function 0050C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A7620: _wcslen.LIBCMT ref: 004A7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0050C6EE
_wcslen.LIBCMT ref: 0050C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0050C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0050C7CA

Strings

0, xrefs: 0050C6AF

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: bad3d4d67fbbf38d97e8a61c7a4f9a0dfb552c41e60cb01d1264d46d3e6c58aa
Instruction ID: 71df39e5a8c5b2701da15b26bdfff544c2895dbed84aa9ef9cf5b7f14e2baad6
Opcode Fuzzy Hash: bad3d4d67fbbf38d97e8a61c7a4f9a0dfb552c41e60cb01d1264d46d3e6c58aa
Instruction Fuzzy Hash: 6351BC716043009BD7649F28C885BAE7FE8FF9A314F040B2EF995E21E0DB64D9089B56

Function 0052AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0052AEA3

Part of subcall function 004A7620: _wcslen.LIBCMT ref: 004A7625

GetProcessId.KERNEL32(00000000), ref: 0052AF38
CloseHandle.KERNEL32(00000000), ref: 0052AF67

Strings

@, xrefs: 0052AE72
<, xrefs: 0052AE6B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 24a0fa662bca07f57fa2c0ff3a5f03e26fa42e1dbc53686cd06668dee1a52176
Instruction ID: aadc42891a9f705ceaeced62b2b851850b76b64c211686d10142d2c57468b4db
Opcode Fuzzy Hash: 24a0fa662bca07f57fa2c0ff3a5f03e26fa42e1dbc53686cd06668dee1a52176
Instruction Fuzzy Hash: 5D718975A00624DFCB14EF55D480A9EBBF4BF0A308F04849EE816AB392C778ED45CB95

Function 0050719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00507206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0050723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0050724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 005072CF

Strings

DllGetClassObject, xrefs: 00507242

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: aea6bd80d312babd7f3be1ed30afdad5991b2deeb70e438274988c737956165c
Instruction ID: d1cefbc49aa23771fee0a03148e30126207f49450e26ad5b8ee60593f86163d7
Opcode Fuzzy Hash: aea6bd80d312babd7f3be1ed30afdad5991b2deeb70e438274988c737956165c
Instruction Fuzzy Hash: 17418F75A04209EFDB15CF54C884A9E7FA9FF48310F1584A9BD059F28AD7B0EE44DBA0

Function 00533D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00533E35
IsMenu.USER32(?), ref: 00533E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00533E92
DrawMenuBar.USER32 ref: 00533EA5

Strings

0, xrefs: 00533D89

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 546e255331d30fc001350a9bea7892cbdc47e2d26c1e798428400ab457db6393
Instruction ID: 482beae9ba2bf9f0803bd015a546e744d492b3193bd964ac4f6666e660a1ac05
Opcode Fuzzy Hash: 546e255331d30fc001350a9bea7892cbdc47e2d26c1e798428400ab457db6393
Instruction Fuzzy Hash: A1414575A01209AFDB10DF64D884EAABBB9FF49354F044129E905AB350D730AE55EF60

Function 00501DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

Part of subcall function 00503CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00503CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00501E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00501E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00501EA9

Part of subcall function 004A6B57: _wcslen.LIBCMT ref: 004A6B6A

Strings

ComboBox, xrefs: 00501DF0
ListBox, xrefs: 00501E25

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 2c603d6d30da51ff471f1964b37fb60b923087815e1929fa44367b34076e5432
Instruction ID: efdf822df6cfa625db4eff740ba83936402bd4b5865862f075b44aa54d54a1c3
Opcode Fuzzy Hash: 2c603d6d30da51ff471f1964b37fb60b923087815e1929fa44367b34076e5432
Instruction Fuzzy Hash: A2212371A00504AADB14AB65CC46CFFBFBDFF563A4B14411EF826A72E0DB384D0A9624

Function 0052C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0052C9F1
_wcslen.LIBCMT ref: 0052CA68
_wcslen.LIBCMT ref: 0052CA9E
_wcslen.LIBCMT ref: 0052CAF9
_wcslen.LIBCMT ref: 0052CB2F
_wcslen.LIBCMT ref: 0052CB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 0052CA62, 0052CA67
HKLM, xrefs: 0052CA98, 0052CA9D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 5737b0d04cd531291b73ea12be878bc798fd266bd03a1970c4f5e630aec0bbd7
Instruction ID: 714eedc2472fe1d66627909ddc48cbf96bbbe491e0c6ffb05f2f646da0139a36
Opcode Fuzzy Hash: 5737b0d04cd531291b73ea12be878bc798fd266bd03a1970c4f5e630aec0bbd7
Instruction Fuzzy Hash: 8331F573A005794ACB20DF2DE9505BE3F91BFA3794B05402EE855AB2C6E775CE8493A0

Function 00532F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00532F8D
LoadLibraryW.KERNEL32(?), ref: 00532F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00532FA9
DestroyWindow.USER32(?), ref: 00532FB1

Strings

SysAnimate32, xrefs: 00532F68

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 28a0443efc7032ab9b90a10b1f6addf72b5ae21e56a27ca391004a4bbf09bdf1
Instruction ID: d733e5b1a6436f4b9d146eae9a0d11c1cc3d8579919235b68d6fa62e46cfb88d
Opcode Fuzzy Hash: 28a0443efc7032ab9b90a10b1f6addf72b5ae21e56a27ca391004a4bbf09bdf1
Instruction Fuzzy Hash: 5B21C071204605ABEB104F64DC86EBB7BBDFF59368F100618F954D6190D771DC91A760

Function 004C4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,004C4D1E,004D28E9,?,004C4CBE,004D28E9,005688B8,0000000C,004C4E15,004D28E9,00000002), ref: 004C4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004C4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,004C4D1E,004D28E9,?,004C4CBE,004D28E9,005688B8,0000000C,004C4E15,004D28E9,00000002,00000000), ref: 004C4DC3

Strings

mscoree.dll, xrefs: 004C4D86
CorExitProcess, xrefs: 004C4D98

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 89aa44add5d80d7385c67ec5f04d1a3a4d9610fcfd70279cd2fb36ec290069e1
Instruction ID: f7afa786729c6fe3e58f63b0576733490d0e1e42e5ce41c68fdfb02f18da0542
Opcode Fuzzy Hash: 89aa44add5d80d7385c67ec5f04d1a3a4d9610fcfd70279cd2fb36ec290069e1
Instruction Fuzzy Hash: C0F0AF39A00208BBDB509F90DC09FEEBFB4EF54715F0000A9F906A63A0CB745A44EB95

Function 004A4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,004A4EDD,?,00571418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 004A4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 004A4EAE
FreeLibrary.KERNEL32(00000000,?,?,004A4EDD,?,00571418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 004A4EC0

Strings

kernel32.dll, xrefs: 004A4E94
Wow64DisableWow64FsRedirection, xrefs: 004A4EA8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: d4c781656a9bbcc5afde37fcd0be2b91531a7aec67b8295639c41ea79f2649d0
Instruction ID: f73da69336b937ffd5a22a32ae1574303b858b0e713e8abbeeb7aa0708dbe7c8
Opcode Fuzzy Hash: d4c781656a9bbcc5afde37fcd0be2b91531a7aec67b8295639c41ea79f2649d0
Instruction Fuzzy Hash: EAE08636A016225BD22117256C18A5F6E54AFE3B63B050116FC01F3300DBA4CD05A2E4

Function 004A4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,004E3CDE,?,00571418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 004A4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 004A4E74
FreeLibrary.KERNEL32(00000000,?,?,004E3CDE,?,00571418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 004A4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 004A4E6E
kernel32.dll, xrefs: 004A4E5B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 03c1db25dcb4add31be38974b31a7687a8f4de29fc3b990e4ea26307610fd9d3
Instruction ID: ea658c250665f79d72f2f690fff0d4d829d627205c10e7f560e2452bea312421
Opcode Fuzzy Hash: 03c1db25dcb4add31be38974b31a7687a8f4de29fc3b990e4ea26307610fd9d3
Instruction Fuzzy Hash: 4DD0C2365026215786221B247C18D8F6E18BFE3B213050112B801F7310CFA4CD01E6D4

Function 00512947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00512C05
DeleteFileW.KERNEL32(?), ref: 00512C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00512C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00512CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00512CC0

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 865df39e31f36bb975ad0f3bab846a7e08fa177adae1088a062473fba4883f69
Instruction ID: 05a7d326caea089a1087901ec25236d256186eedfd49c8efecfbf53d38b2a259
Opcode Fuzzy Hash: 865df39e31f36bb975ad0f3bab846a7e08fa177adae1088a062473fba4883f69
Instruction Fuzzy Hash: 20B18E71D00119ABDF10DBA5CD89EDEBBBDFF59344F0040AAF609E6141EA349E948FA0

Function 0052A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0052A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0052A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0052A468
CloseHandle.KERNEL32(?), ref: 0052A63D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 9fd7caafe72465d06ae2156641a7d43d58d5741e463da3e65d737d3eb6b4de69
Instruction ID: 6a452c60ad567bf63cf2e25b5082a5c9df01d66684313ef79f3425a6e37f12e4
Opcode Fuzzy Hash: 9fd7caafe72465d06ae2156641a7d43d58d5741e463da3e65d737d3eb6b4de69
Instruction Fuzzy Hash: 65A1CF71604300AFD720DF25D882F2ABBE1AF95718F14881DF95A9B3D2D7B4EC418B92

Function 0050E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0050DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0050CF22,?), ref: 0050DDFD

Part of subcall function 0050DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0050CF22,?), ref: 0050DE16

Part of subcall function 0050E199: GetFileAttributesW.KERNEL32(?,0050CF95), ref: 0050E19A

lstrcmpiW.KERNEL32(?,?), ref: 0050E473
MoveFileW.KERNEL32(?,?), ref: 0050E4AC
_wcslen.LIBCMT ref: 0050E5EB
_wcslen.LIBCMT ref: 0050E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0050E650

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: a0e4575f1f7f1c79a283d9cb1ff3379e1e494e99345b6cea2bf2dbf636107f6a
Instruction ID: 39d2a050aa5ae1e4ee2b75842fc07ef5354295bc2c7c191867345f0c33e21eb6
Opcode Fuzzy Hash: a0e4575f1f7f1c79a283d9cb1ff3379e1e494e99345b6cea2bf2dbf636107f6a
Instruction Fuzzy Hash: 8151C1B20083455BC764EBA0DC81ADFB7ECAF95344F104D2EF589D3191EF35A688876A

Function 0052B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

Part of subcall function 0052C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0052B6AE,?,?), ref: 0052C9B5
Part of subcall function 0052C998: _wcslen.LIBCMT ref: 0052C9F1
Part of subcall function 0052C998: _wcslen.LIBCMT ref: 0052CA68
Part of subcall function 0052C998: _wcslen.LIBCMT ref: 0052CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0052BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0052BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0052BB63
RegCloseKey.ADVAPI32(?,?), ref: 0052BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0052BBB3

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 6f1597e03df1b417f3b389dc45b0e2005cafcc4c3c487f6e01b53833038b074f
Instruction ID: da0b422becb2bc7c4e88408962d3624c7bcddf7c5e893ea422e8f46ce2f6aee4
Opcode Fuzzy Hash: 6f1597e03df1b417f3b389dc45b0e2005cafcc4c3c487f6e01b53833038b074f
Instruction Fuzzy Hash: B161D231208241EFD714DF14D494E2ABBE5FF86348F14895DF4998B2A2CB35ED45CB92

Function 00508BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00508BCD
VariantClear.OLEAUT32 ref: 00508C3E
VariantClear.OLEAUT32 ref: 00508C9D
VariantClear.OLEAUT32(?), ref: 00508D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00508D3B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 67027d7bc22bb73cf38aa6faa8d34c2436268ef1d5172119f94205dddde989be
Instruction ID: f6fc9e4cfb0d0a918fa4c3c28f933af3eed9699f9633ef286f89061fd803bade
Opcode Fuzzy Hash: 67027d7bc22bb73cf38aa6faa8d34c2436268ef1d5172119f94205dddde989be
Instruction Fuzzy Hash: 275169B5A00619EFCB10CF68C884EAABBF8FF89310B158559E945EB350E730E911CF90

Function 00518AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00518BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00518BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00518C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00518C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00518C5F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: d097a5e717325e0e3ef0ac4255d346a8b9f61ccaeb9307a6c3d7bc5646c30d05
Instruction ID: 48ed5a2f0088bba1a4a19a516ae52ba986955db292bf5c9ad6d5741f93631ecf
Opcode Fuzzy Hash: d097a5e717325e0e3ef0ac4255d346a8b9f61ccaeb9307a6c3d7bc5646c30d05
Instruction Fuzzy Hash: 40515C35A00214EFDB10DF65C881AAEBBF5FF49318F088459E849AB362DB35ED51CB94

Function 00528EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00528F40
GetProcAddress.KERNEL32(00000000,?), ref: 00528FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00528FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00529032
FreeLibrary.KERNEL32(00000000), ref: 00529052

Part of subcall function 004BF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00511043,?,753CE610), ref: 004BF6E6
Part of subcall function 004BF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,004FFA64,00000000,00000000,?,?,00511043,?,753CE610,?,004FFA64), ref: 004BF70D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 9e55167907ee8d8bd679d393f91ebf2431d486d3aca77a60a6bbda1877fe18e0
Instruction ID: afa2967b487786e0d057880b6ae137f574b78e0f72714e1dcbdb4539bec87efb
Opcode Fuzzy Hash: 9e55167907ee8d8bd679d393f91ebf2431d486d3aca77a60a6bbda1877fe18e0
Instruction Fuzzy Hash: 46513B35601215DFC711DF55C4948ADBBF1FF5A358F088099E809AB3A2DB35ED85CB90

Function 00536B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00536C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00536C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00536C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0051AB79,00000000,00000000), ref: 00536C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00536CC7

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 1f8606d3f36ee6eb02067a52a8264d4c44cf76c82dcd4275727bbc7d9512c7bd
Instruction ID: f92e567ea896ef7e08cfcf4c033f0455083949e495e2eeb2b14e124a1d237866
Opcode Fuzzy Hash: 1f8606d3f36ee6eb02067a52a8264d4c44cf76c82dcd4275727bbc7d9512c7bd
Instruction Fuzzy Hash: 7A419F35A04108BFDB24CF28CC59FA9BFA5FB09350F15926CE999AB2A0C371ED41DA50

Function 004D2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004D20C3
_free.LIBCMT ref: 004D20E3

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8278a529b8511cd5b4d8d439836626147d5d47dea23f7f834331e0d00fc6c22d
Instruction ID: 73624924707184cdf360c3704b0622ae999bd3ba329219284d3ee96301d52486
Opcode Fuzzy Hash: 8278a529b8511cd5b4d8d439836626147d5d47dea23f7f834331e0d00fc6c22d
Instruction Fuzzy Hash: 6141F172A00200AFCB20DF79CA90A6EB7A1EF98314B1581ABE605EB351D675AD01DB84

Function 004B912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 004B9141
ScreenToClient.USER32(00000000,?), ref: 004B915E
GetAsyncKeyState.USER32(00000001), ref: 004B9183
GetAsyncKeyState.USER32(00000002), ref: 004B919D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: d7de96cefd6a2ca4caf2f3af7438b1459ea497de69199326e38686625a011cb5
Instruction ID: 44a3687bc63bb7d2c6213aeb26a0ee827d1b0b6934370cdc3a48f9d94b03f076
Opcode Fuzzy Hash: d7de96cefd6a2ca4caf2f3af7438b1459ea497de69199326e38686625a011cb5
Instruction Fuzzy Hash: 86416E3190850ABBDF059F68C848BFEBB74FF05324F20821AE525A6390C7385D54DBA5

Function 00513874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 005138CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00513922
TranslateMessage.USER32(?), ref: 0051394B
DispatchMessageW.USER32(?), ref: 00513955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00513966

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: cc5be42a307d35be0a530c1148c284ddff06b1534c267c8b54b782476b8967d7
Instruction ID: 72f8197354708105b4dd258720084311bd6b05febb8f12e5544e74e66b0ef517
Opcode Fuzzy Hash: cc5be42a307d35be0a530c1148c284ddff06b1534c267c8b54b782476b8967d7
Instruction Fuzzy Hash: 6C31D770504741AEFB35CF34A869FF63FA8FB25304F04096DE466961A0E3B496C9EB51

Function 0051CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0051CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0051CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0051C21E,00000000), ref: 0051CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0051C21E,00000000), ref: 0051CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0051C21E,00000000), ref: 0051CFF2

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 6845aebca8b34541a48e0bab7d5e4d9687559616519f61e9b80cbecf4fbdd46e
Instruction ID: 302d35c1f7ed2fc26905cbef6dc9018905298bea0f4ce799f378b830770e7116
Opcode Fuzzy Hash: 6845aebca8b34541a48e0bab7d5e4d9687559616519f61e9b80cbecf4fbdd46e
Instruction Fuzzy Hash: 52314C71540205AFEB20DFA5C884AEBBFF9FB14354B10442EF516E2241EB35EE86DB60

Function 00501901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00501915
PostMessageW.USER32(00000001,00000201,00000001), ref: 005019C1
Sleep.KERNEL32(00000000,?,?,?), ref: 005019C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 005019DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 005019E2

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 7f8a26ec0c9f414a0d8a8bdf9413fe42b743a0997cddbf17f5e9b7c4e986b584
Instruction ID: cd2151c67f36e2aa164911053bd805ac140f566802e90625e2e5d8c7a085025e
Opcode Fuzzy Hash: 7f8a26ec0c9f414a0d8a8bdf9413fe42b743a0997cddbf17f5e9b7c4e986b584
Instruction Fuzzy Hash: 5231AB72A00619EFCB00CFA8C999AEE3FB5FB55315F104629F921AB2D1C7709944DB91

Function 00535706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00535745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0053579D
_wcslen.LIBCMT ref: 005357AF
_wcslen.LIBCMT ref: 005357BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00535816

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 7094e2a78ffee37e319e9523237455d1a73c388a1b9c22dab153c0111b8de7e4
Instruction ID: c608c11c651eaab8b756a8c8aff042b781a7a1a1713aabf17f3d3da0e7064178
Opcode Fuzzy Hash: 7094e2a78ffee37e319e9523237455d1a73c388a1b9c22dab153c0111b8de7e4
Instruction Fuzzy Hash: E421B475904618DADF208FA4DC85AEE7FB8FF54324F109616F929EB280E7708A85CF50

Function 00520930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00520951
GetForegroundWindow.USER32 ref: 00520968
GetDC.USER32(00000000), ref: 005209A4
GetPixel.GDI32(00000000,?,00000003), ref: 005209B0
ReleaseDC.USER32(00000000,00000003), ref: 005209E8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: ca4bdc9edf7db7880115061acc8d2ec738cd1eb3058cda3d979ab87f0a0aa99e
Instruction ID: f8504a9b7c69b31bf5fbf68aadf519302762f82a71f697fbe1eebb53fde82fbc
Opcode Fuzzy Hash: ca4bdc9edf7db7880115061acc8d2ec738cd1eb3058cda3d979ab87f0a0aa99e
Instruction Fuzzy Hash: 3A219235600214AFD704EF69D889A9EBFE9FF55704F04806DE846A77A2CB30EC44DB50

Function 004DCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004DCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004DCDE9

Part of subcall function 004D3820: RtlAllocateHeap.NTDLL(00000000,?,00571444,?,004BFDF5,?,?,004AA976,00000010,00571440,004A13FC,?,004A13C6,?,004A1129), ref: 004D3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 004DCE0F
_free.LIBCMT ref: 004DCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004DCE31

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 51c9930ebc4d2ebdc1bf504d1d5c1ce44a23723169e9d13d3d9a65e409eee7a9
Instruction ID: 1f347b65c043104c556d92dbb09e32f9ec8e9e622d886afd85ebe7e4e030651a
Opcode Fuzzy Hash: 51c9930ebc4d2ebdc1bf504d1d5c1ce44a23723169e9d13d3d9a65e409eee7a9
Instruction Fuzzy Hash: E801D8B26012167F272116BB6CD8D7BBE6DDEC6BA1315012FF905D7300DA688D01E2B8

Function 004B9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 004B9693
SelectObject.GDI32(?,00000000), ref: 004B96A2
BeginPath.GDI32(?), ref: 004B96B9
SelectObject.GDI32(?,00000000), ref: 004B96E2

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 59357b07dc6a9a93b7f5cd925db798d35fd38e81bc3b11231a92d99b680ff21f
Instruction ID: 900595c293c3dde660d2266b34033597605224f22292ad039bc82859a20f491e
Opcode Fuzzy Hash: 59357b07dc6a9a93b7f5cd925db798d35fd38e81bc3b11231a92d99b680ff21f
Instruction Fuzzy Hash: 14216031801609EFDB119F68EC197EA7BA4BB20315F100216F614A62A0D3785C9AFBAC

Function 00505711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00505726
_memcmp.LIBVCRUNTIME ref: 00505744
_memcmp.LIBVCRUNTIME ref: 00505757
_memcmp.LIBVCRUNTIME ref: 0050576F
_memcmp.LIBVCRUNTIME ref: 00505787

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: be35defa462cff15f14e53220a40ea779808354600c74c13867cb7b23414113b
Instruction ID: 5597f931321d24283a1b0f6337ebff991f55aba7de74a98ea82d2db5c3f27203
Opcode Fuzzy Hash: be35defa462cff15f14e53220a40ea779808354600c74c13867cb7b23414113b
Instruction Fuzzy Hash: A301F5A5681609BBE71851119E82FBF7B4CFF223DCF000029FE049A6D2F724ED109BA5

Function 004D2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,004CF2DE,004D3863,00571444,?,004BFDF5,?,?,004AA976,00000010,00571440,004A13FC,?,004A13C6), ref: 004D2DFD
_free.LIBCMT ref: 004D2E32
_free.LIBCMT ref: 004D2E59
SetLastError.KERNEL32(00000000,004A1129), ref: 004D2E66
SetLastError.KERNEL32(00000000,004A1129), ref: 004D2E6F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 05379d2809ef9f9537c1598ab47dbaf6ba497e34363a2a3093be285155ce257f
Instruction ID: 85f5a68adde4843e24fc77e1bc117ef09d159e6b2df23745c4fdea625e817f7e
Opcode Fuzzy Hash: 05379d2809ef9f9537c1598ab47dbaf6ba497e34363a2a3093be285155ce257f
Instruction Fuzzy Hash: 53017D726006006BC61227366E65D2B2B5DABF13BA720042FF424E33D2EFFCCC056129

Function 0050000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,004FFF41,80070057,?,?,?,0050035E), ref: 0050002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004FFF41,80070057,?,?), ref: 00500046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004FFF41,80070057,?,?), ref: 00500054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004FFF41,80070057,?), ref: 00500064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,004FFF41,80070057,?,?), ref: 00500070

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 4572ddb1c256ba616e40744fa48ca91d37cae0781fb0e014c61942aefe6f9ba0
Instruction ID: 2a4efca5337a25b900daebad65bbb9f78a63b178c0c89f5cf2456f5745d12bbd
Opcode Fuzzy Hash: 4572ddb1c256ba616e40744fa48ca91d37cae0781fb0e014c61942aefe6f9ba0
Instruction Fuzzy Hash: 3F018F76600204BFDB104F69DC0CBAEBEADFB44751F145124F905E2290DB71DE44ABA0

Function 005010F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00501114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00500B9B,?,?,?), ref: 00501120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00500B9B,?,?,?), ref: 0050112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00500B9B,?,?,?), ref: 00501136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0050114D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 82d6765795fc646808c660579ab0fa94437c6ef80c7ece88750b4ac07b156caf
Instruction ID: ed55c61409f936e0ae8b71c258e5478d25f48919500c578e03f84f9269883d30
Opcode Fuzzy Hash: 82d6765795fc646808c660579ab0fa94437c6ef80c7ece88750b4ac07b156caf
Instruction Fuzzy Hash: 8B011975200615BFDB154FA5DC49A6A3F6EFF893A0B204419FA45E73A0DA31DC04EB60

Function 00500FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00500FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00500FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00500FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00500FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00501002

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d96a8a6a1a866f946ca0cebf37b4ca3e89b04a336045a7a78f27628c3e2d59a3
Instruction ID: 35fde62185e266233b4bcadb5e659d8ab3180b737910b6a66f753361f1208a1c
Opcode Fuzzy Hash: d96a8a6a1a866f946ca0cebf37b4ca3e89b04a336045a7a78f27628c3e2d59a3
Instruction Fuzzy Hash: AAF04935200701ABDB224FA59C4DF5A3FADFF99762F104414FA85E7391DA70DC54AB60

Function 00501014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0050102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00501036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00501045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0050104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00501062

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 55b55a2fd34d6c5afbc79c08d3612e7c800f674615d8e23a34852e27215766f7
Instruction ID: 806e8aa3838f74d13105c10fdce562bae60724bed2d9d905174aaa64767a0242
Opcode Fuzzy Hash: 55b55a2fd34d6c5afbc79c08d3612e7c800f674615d8e23a34852e27215766f7
Instruction Fuzzy Hash: 77F04935200701ABDB215FA6EC5DF5A3FADFF99761F100414FA85E7390CA70D854AB60

Function 0051030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0051017D,?,005132FC,?,00000001,004E2592,?), ref: 00510324
CloseHandle.KERNEL32(?,?,?,?,0051017D,?,005132FC,?,00000001,004E2592,?), ref: 00510331
CloseHandle.KERNEL32(?,?,?,?,0051017D,?,005132FC,?,00000001,004E2592,?), ref: 0051033E
CloseHandle.KERNEL32(?,?,?,?,0051017D,?,005132FC,?,00000001,004E2592,?), ref: 0051034B
CloseHandle.KERNEL32(?,?,?,?,0051017D,?,005132FC,?,00000001,004E2592,?), ref: 00510358
CloseHandle.KERNEL32(?,?,?,?,0051017D,?,005132FC,?,00000001,004E2592,?), ref: 00510365

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f523c33a0e2e4d3bcdeda4be8dc80eac9a6586cb9594614bb726307828efa4c8
Instruction ID: 3a1da09ee6cf4471f92bf7bf26bb5d326d8cb1bb3a379996a25451fa1332d864
Opcode Fuzzy Hash: f523c33a0e2e4d3bcdeda4be8dc80eac9a6586cb9594614bb726307828efa4c8
Instruction Fuzzy Hash: AC01EE72800B018FDB30AF66D880842FBF9BF603053049E3FD1A252970C3B0A999DF80

Function 004DD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004DD752

Part of subcall function 004D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,004DD7D1,00000000,00000000,00000000,00000000,?,004DD7F8,00000000,00000007,00000000,?,004DDBF5,00000000), ref: 004D29DE
Part of subcall function 004D29C8: GetLastError.KERNEL32(00000000,?,004DD7D1,00000000,00000000,00000000,00000000,?,004DD7F8,00000000,00000007,00000000,?,004DDBF5,00000000,00000000), ref: 004D29F0

_free.LIBCMT ref: 004DD764
_free.LIBCMT ref: 004DD776
_free.LIBCMT ref: 004DD788
_free.LIBCMT ref: 004DD79A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 397f8c71c66650d8342054bd906db316f57ae4f501e1b16e2cec890808008fc0
Instruction ID: bdfa8ef44a19b3842e31d249ff9ffa21381d00260226b1c7294e1c492359a58e
Opcode Fuzzy Hash: 397f8c71c66650d8342054bd906db316f57ae4f501e1b16e2cec890808008fc0
Instruction Fuzzy Hash: C1F068B2A402046B8631EB59FAE5C177BDDBB54310B94084BF059D7702C778FC405668

Function 00505C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00505C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00505C6F
MessageBeep.USER32(00000000), ref: 00505C87
KillTimer.USER32(?,0000040A), ref: 00505CA3
EndDialog.USER32(?,00000001), ref: 00505CBD

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: d8b232672574d8ff4bf1ab540f27aca8870a72f097cb7dfa52f77abb8b72b51a
Instruction ID: 943addd37f4ce1b1b9149d4b2d15fe3516be17a6d49e1b0225e0159e02bf69e2
Opcode Fuzzy Hash: d8b232672574d8ff4bf1ab540f27aca8870a72f097cb7dfa52f77abb8b72b51a
Instruction Fuzzy Hash: 30011D31500B04ABFB215B14DE4FFAA7FB8BB14B05F041559A583B15E1EBF4AD889F90

Function 004D22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004D22BE

Part of subcall function 004D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,004DD7D1,00000000,00000000,00000000,00000000,?,004DD7F8,00000000,00000007,00000000,?,004DDBF5,00000000), ref: 004D29DE
Part of subcall function 004D29C8: GetLastError.KERNEL32(00000000,?,004DD7D1,00000000,00000000,00000000,00000000,?,004DD7F8,00000000,00000007,00000000,?,004DDBF5,00000000,00000000), ref: 004D29F0

_free.LIBCMT ref: 004D22D0
_free.LIBCMT ref: 004D22E3
_free.LIBCMT ref: 004D22F4
_free.LIBCMT ref: 004D2305

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3f88d405b040507c24fb3a3d41b49908f59535974696edec5c205b802ee1e01a
Instruction ID: b552ea2180cbec275c4b7b912fc92a2d4d3d8acd2c2402edac7b2abde70d6bab
Opcode Fuzzy Hash: 3f88d405b040507c24fb3a3d41b49908f59535974696edec5c205b802ee1e01a
Instruction Fuzzy Hash: 90F030F85005108B8622AF69BD218193FA4B739750700158BF418D33B2CBB80499BBAC

Function 004B95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 004B95D4
StrokeAndFillPath.GDI32(?,?,004F71F7,00000000,?,?,?), ref: 004B95F0
SelectObject.GDI32(?,00000000), ref: 004B9603
DeleteObject.GDI32 ref: 004B9616
StrokePath.GDI32(?), ref: 004B9631

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 306c0f34dd7a38b0698da7e48d5a711e47ed33bfd5d619047f3ac3c14b89a516
Instruction ID: 61e18f95751a19781432b5bd713162ceadf0d077cd7b7619216c0587e1120c20
Opcode Fuzzy Hash: 306c0f34dd7a38b0698da7e48d5a711e47ed33bfd5d619047f3ac3c14b89a516
Instruction Fuzzy Hash: F6F03131005644EBDB265F59FD1C7A93F61A720322F048215F619652F0C734499AFF28

Function 004D0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 004D10F9
__freea.LIBCMT ref: 004D1117

Part of subcall function 004D1537: _free.LIBCMT ref: 004D154F

Strings

am/pm, xrefs: 004D117A
a/p, xrefs: 004D11DE

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 591436bf7b1ead1b77389bf3439b6eee8c5d050d180d00cdac861c492e1e1359
Instruction ID: 7829ae3e262b7677979b964a721e474b375fc504f10e1e6dbba51c54b20d54b7
Opcode Fuzzy Hash: 591436bf7b1ead1b77389bf3439b6eee8c5d050d180d00cdac861c492e1e1359
Instruction Fuzzy Hash: 04D1D335900205EAEB299F68C865BBFB7B1EF06300F24415BED01ABB61D37D9D81CB59

Function 005261D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 004C0242: EnterCriticalSection.KERNEL32(0057070C,00571884,?,?,004B198B,00572518,?,?,?,004A12F9,00000000), ref: 004C024D
Part of subcall function 004C0242: LeaveCriticalSection.KERNEL32(0057070C,?,004B198B,00572518,?,?,?,004A12F9,00000000), ref: 004C028A

Part of subcall function 004C00A3: __onexit.LIBCMT ref: 004C00A9

__Init_thread_footer.LIBCMT ref: 00526238

Part of subcall function 004C01F8: EnterCriticalSection.KERNEL32(0057070C,?,?,004B8747,00572514), ref: 004C0202
Part of subcall function 004C01F8: LeaveCriticalSection.KERNEL32(0057070C,?,004B8747,00572514), ref: 004C0235

Part of subcall function 0051359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 005135E4
Part of subcall function 0051359C: LoadStringW.USER32(00572390,?,00000FFF,?), ref: 0051360A

Strings

x#W, xrefs: 0052633A
x#W, xrefs: 00526353
x#W, xrefs: 0052636F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#W$x#W$x#W
API String ID: 1072379062-177975842
Opcode ID: 82df2b7a8a2650e028ef4873bc2d087abb94348630fd7b03b1b894bf73434e7c
Instruction ID: e8fe29ebde2eba31f24a0c40df9f8b1d4d038f111b2c7e78bb2912e43c536769
Opcode Fuzzy Hash: 82df2b7a8a2650e028ef4873bc2d087abb94348630fd7b03b1b894bf73434e7c
Instruction Fuzzy Hash: F8C18C71A00115AFCB14EF58D890EBEBBB9FF59300F10846AF945AB291DB74ED45CBA0

Function 004D5AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JOJ, xrefs: 004D5BA8, 004D5C6C

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID: JOJ
API String ID: 0-1671703104
Opcode ID: 10cb7a235458f99482229239ad99107f1e03f4c13942c2a951c27e57e54a586a
Instruction ID: 0851f5559cae9c59621fcd6269306dd900ee53fe625c7c230792fba1db333b9d
Opcode Fuzzy Hash: 10cb7a235458f99482229239ad99107f1e03f4c13942c2a951c27e57e54a586a
Instruction Fuzzy Hash: F1510E75D10609AFCB209FA9C865FAFBBB8AF05314F10005FF404A7391DA7D9902DB6A

Function 004D8A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 004D8B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 004D8B7A
__dosmaperr.LIBCMT ref: 004D8B81

Strings

.L, xrefs: 004D8A63

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .L
API String ID: 2434981716-3603714933
Opcode ID: b11d1288e111b4b7f0cb58a01c8eeafcb61b3f2523b862388bcd44b24403f3f3
Instruction ID: f705f8de240f893f00e316c66d7ac12746a8ff5b57d0ba79aee0f0411a468182
Opcode Fuzzy Hash: b11d1288e111b4b7f0cb58a01c8eeafcb61b3f2523b862388bcd44b24403f3f3
Instruction Fuzzy Hash: EB416E74604185AFDB259F28DCA0A7E7FE5DB86304F2841AFF88587342DE39DC02A758

Function 00502716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0050B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005021D0,?,?,00000034,00000800,?,00000034), ref: 0050B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00502760

Part of subcall function 0050B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005021FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0050B3F8

Part of subcall function 0050B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0050B355
Part of subcall function 0050B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00502194,00000034,?,?,00001004,00000000,00000000), ref: 0050B365
Part of subcall function 0050B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00502194,00000034,?,?,00001004,00000000,00000000), ref: 0050B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005027CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0050281A

Strings

@, xrefs: 00502832

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: d07da12a62946fbd84bd996b373b3d7ee89370b57a882f8190d695230b16f855
Instruction ID: d0a7dbc24008c70e583f30f0e2fa1e66ec0b627f51d411f5aadf39c642e2cb93
Opcode Fuzzy Hash: d07da12a62946fbd84bd996b373b3d7ee89370b57a882f8190d695230b16f855
Instruction Fuzzy Hash: 3D414E76900219AFDB10DFA4CD86AEEBBB8FF49300F108059FA55B7191DB706E45CBA0

Function 004D172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 004D1769
_free.LIBCMT ref: 004D1834
_free.LIBCMT ref: 004D183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 004D1760, 004D1767, 004D1796, 004D17CE

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 3b750918483f51c30d36e65d96f8124540b34034e2775967484186f50bcc9699
Instruction ID: 75ca5b3c558207cf6efa8647c92e58b4f7f268def70b5063f935c104275a356d
Opcode Fuzzy Hash: 3b750918483f51c30d36e65d96f8124540b34034e2775967484186f50bcc9699
Instruction Fuzzy Hash: D33182B5A00218BFDB21DB9AD895D9FBBFCEB95310B1041ABF804D7321D6744E44EB98

Function 0050C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0050C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0050C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00571990,00A679C0), ref: 0050C395

Strings

0, xrefs: 0050C2DF

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 3c9ed2c0372c0d837f300fba970c6dac579a7d6f4e1861a201f12cf930bd3ba3
Instruction ID: 8ffbde03f868d368ce7a2d47c5af4f3fe25c93cda34d97a322d7804d8ac30ac5
Opcode Fuzzy Hash: 3c9ed2c0372c0d837f300fba970c6dac579a7d6f4e1861a201f12cf930bd3ba3
Instruction Fuzzy Hash: 59417C312043029FD720DF25D885B9EBFA4BB96324F148B1EF9A5972D1D770A904CB62

Function 00534416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0053CC08,00000000,?,?,?,?), ref: 005344AA
GetWindowLongW.USER32 ref: 005344C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 005344D7

Strings

SysTreeView32, xrefs: 0053447C

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: db8612c7913a32e830cb6530db190f77dd846293b2b949386fd12bf91d662bf7
Instruction ID: 394659fdac89857fd88d0c8b1e4727b51cbdb7b5fb6140844a96c6e697b7c45c
Opcode Fuzzy Hash: db8612c7913a32e830cb6530db190f77dd846293b2b949386fd12bf91d662bf7
Instruction Fuzzy Hash: 50319E32210605AFDF209E78DC45BEA7BA9FB09338F244729F975A22D0D774EC509B50

Function 00506E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00506EED
VariantCopyInd.OLEAUT32(?,?), ref: 00506F08
VariantClear.OLEAUT32(?), ref: 00506F12

Strings

*jP, xrefs: 00506E8B, 00506E90, 00506EF8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *jP
API String ID: 2173805711-1055049981
Opcode ID: 4ad6ae25dcd957293385b70ab56cffb497d70b05607e14d47abdaafc375f0100
Instruction ID: d5130c20d230c73aad919e09abca3aa8f2bce4b1afda7b175a050a4c7e21659c
Opcode Fuzzy Hash: 4ad6ae25dcd957293385b70ab56cffb497d70b05607e14d47abdaafc375f0100
Instruction Fuzzy Hash: 8D31C471604246DFCB04AFA5E8509BE3B76FF55708B1008ADF8024B2E2C7349961DBD4

Function 0052304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0052335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00523077,?,?), ref: 00523378

inet_addr.WSOCK32(?), ref: 0052307A
_wcslen.LIBCMT ref: 0052309B
htons.WSOCK32(00000000), ref: 00523106

Strings

255.255.255.255, xrefs: 00523095, 0052309A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 1bfffce1471e4011fe9413493f3f74e3c32b58b772b2e3b70bf11e67db068e9a
Instruction ID: 144fd9267943ddb584f6b6925a1c36920b86c1f44d9b92ead8792d012da5dde1
Opcode Fuzzy Hash: 1bfffce1471e4011fe9413493f3f74e3c32b58b772b2e3b70bf11e67db068e9a
Instruction Fuzzy Hash: 7D31C1392002219FC710CF68D485EA97BE0FF56318F248459E8158B3E2CB79DE45C760

Function 00533EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00533F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00533F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00533F78

Strings

SysMonthCal32, xrefs: 00533F0B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 827475f086c2b4523f13ba185fecd3e8fca636cb9c212e71fe16945c33e701c0
Instruction ID: 892b39829b8f14a150b545df7272c6f3f359e3d3a7cdbebb83629a0215f525c9
Opcode Fuzzy Hash: 827475f086c2b4523f13ba185fecd3e8fca636cb9c212e71fe16945c33e701c0
Instruction Fuzzy Hash: 8621BF32600219BBDF218F54DC46FEA3F79FB88714F110214FA156B1D0D6B5AC94DB90

Function 00534653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00534705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00534713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0053471A

Strings

msctls_updown32, xrefs: 00534684

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: edae5b30017e46834f2fd8f90f02128e03af4ed586f67d9db02c8896523508f7
Instruction ID: ee3b468214ff4f0ca733ca17afd0f85c0c2f83121cca870d01dac3a669eed37f
Opcode Fuzzy Hash: edae5b30017e46834f2fd8f90f02128e03af4ed586f67d9db02c8896523508f7
Instruction Fuzzy Hash: BF215EB5600209AFDB10DF68DCC1DA73BADFB5A398B040059FA059B291CB70FC52DA60

Function 005095AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0050961D

Strings

#requireadmin, xrefs: 005095D9
#OnAutoItStartRegister, xrefs: 005095F3
#notrayicon, xrefs: 005095B7

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 8cfd5b55016e4b0949d51f2dae9ba6a9ad33123ab9a3820637ed1d40c0f91dd9
Instruction ID: bee065988c22f21db5bc1466b8d90af2d7f5e80b90a3b4b5ef8a44bf35b9049d
Opcode Fuzzy Hash: 8cfd5b55016e4b0949d51f2dae9ba6a9ad33123ab9a3820637ed1d40c0f91dd9
Instruction Fuzzy Hash: 0021387210451166C331AA269C12FBF7B98BFA5314F10442EF949970C6EB56AD41C3D9

Function 005337B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00533840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00533850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00533876

Strings

Listbox, xrefs: 0053380F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 73dd7153766c4e7871387ae569efd44b1815fffd5a92c7c2140af0d3be9f8212
Instruction ID: 3b9bcce0ae609db51587e3c57d386b4c226d43a2203c6946b74eaf0801e21657
Opcode Fuzzy Hash: 73dd7153766c4e7871387ae569efd44b1815fffd5a92c7c2140af0d3be9f8212
Instruction Fuzzy Hash: 6521D172610218BBEF218F64DC85FBB3B6EFF99764F118124F904AB190C671DD5287A0

Function 005149F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00514A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00514A5C
SetErrorMode.KERNEL32(00000000,?,?,0053CC08), ref: 00514AD0

Strings

%lu, xrefs: 00514A6F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 97da4518d4f24a63e1b5e26655e2bd7c118506908621f0a7d77d072b8b0465e3
Instruction ID: 0c4b80c7415959aae5c4bc563a82a8d7c9f0bdea572a37db65c9a89a4b423d68
Opcode Fuzzy Hash: 97da4518d4f24a63e1b5e26655e2bd7c118506908621f0a7d77d072b8b0465e3
Instruction Fuzzy Hash: 1D317C75A00209AFDB10DF54C885EAA7BF8EF09308F1480A9F909EB352D775EE45CB61

Function 005341EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0053424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00534264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00534271

Strings

msctls_trackbar32, xrefs: 00534226

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 3c06d88bf084e78f939fba4bbafc171ff56b14cbbec6e3b5330f4f41d253bdc9
Instruction ID: 8cfc82df176dc240bb533fdd9bd6a9e68bab3b2fd2c8c84c37f191f08fb6503d
Opcode Fuzzy Hash: 3c06d88bf084e78f939fba4bbafc171ff56b14cbbec6e3b5330f4f41d253bdc9
Instruction Fuzzy Hash: EF11A331240248BEEF215E69CC06FAB3FACFF95B54F110514FA55E61A0D671EC519B24

Function 00502F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A6B57: _wcslen.LIBCMT ref: 004A6B6A

Part of subcall function 00502DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00502DC5
Part of subcall function 00502DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00502DD6
Part of subcall function 00502DA7: GetCurrentThreadId.KERNEL32 ref: 00502DDD
Part of subcall function 00502DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00502DE4

GetFocus.USER32 ref: 00502F78

Part of subcall function 00502DEE: GetParent.USER32(00000000), ref: 00502DF9

GetClassNameW.USER32(?,?,00000100), ref: 00502FC3
EnumChildWindows.USER32(?,0050303B), ref: 00502FEB

Strings

%s%d, xrefs: 00502FFF

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 1da5a6a2ac9263c55e4073a7aaddd05d2d38ca130dee9e98965f5d642ced2fae
Instruction ID: cb8903da10898fd870168944d5e03a852d0e2df699321f44384519279df7c380
Opcode Fuzzy Hash: 1da5a6a2ac9263c55e4073a7aaddd05d2d38ca130dee9e98965f5d642ced2fae
Instruction Fuzzy Hash: A611A5716002056BCF15BF648C9AEED7B6ABF94304F044079B909AB292DE349D499B70

Function 00535882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 005358C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 005358EE
DrawMenuBar.USER32(?), ref: 005358FD

Strings

0, xrefs: 0053588F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 179ad4259658655a4166bab79593726291bec93210b0cf65ad8b39efa17fdd39
Instruction ID: 21910b7791c00ad88241909f7f7295739d6b3204b8f19a94b64bfa3bf2a9cd73
Opcode Fuzzy Hash: 179ad4259658655a4166bab79593726291bec93210b0cf65ad8b39efa17fdd39
Instruction Fuzzy Hash: FE011B32500218EEDB219F21DC45BAEBFB5FB45365F10849AF849D6251EB348A98EF31

Function 004FD3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 004FD3BF
FreeLibrary.KERNEL32 ref: 004FD3E5

Strings

GetSystemWow64DirectoryW, xrefs: 004FD3B9
X64, xrefs: 004FD2A8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 4743174aa4035f1cf6aab95e2ffbf55300d5b73cc3349c1233fdf30635d3d3ca
Instruction ID: c2fa362edce52029f89a0e8cd886d8a8096247b1cc21023ad3e1710442f7cdd6
Opcode Fuzzy Hash: 4743174aa4035f1cf6aab95e2ffbf55300d5b73cc3349c1233fdf30635d3d3ca
Instruction Fuzzy Hash: 37F02022C05A289AE73112108C549BA3B55AF10B01B568597AB02F6308D72CCC49A3EF

Function 0050007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35215f246a90a02ce8f913828d65cafccc0d6baf5ba098faac38dc2d06c2c3b1
Instruction ID: e89c3e89b6fb86f1c4a389585ab5b495e7ca3ce52cecd2459c6b911e4ddbe6ad
Opcode Fuzzy Hash: 35215f246a90a02ce8f913828d65cafccc0d6baf5ba098faac38dc2d06c2c3b1
Instruction Fuzzy Hash: C8C14975A0020AEFCB15CFA4C894BAEBBB5FF48314F249598E505EB291D731EE41DB90

Function 0052342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00523459
CoUninitialize.OLE32 ref: 00523463
VariantInit.OLEAUT32(?), ref: 0052346E
VariantClear.OLEAUT32(?), ref: 0052371B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: a771ed0164971b4a507304502a417dcbf03c42f0e32c9853669e3f3d88b0b702
Instruction ID: 1b770eb7f51f99316e806ef49c4e06a57318da367d1d7c3e68477546f8792f7f
Opcode Fuzzy Hash: a771ed0164971b4a507304502a417dcbf03c42f0e32c9853669e3f3d88b0b702
Instruction Fuzzy Hash: B0A180756043109FC710EF25D485A2ABBE5FF89318F04885DF98A9B3A2DB34EE05CB95

Function 00500436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0053FC08,?), ref: 005005F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0053FC08,?), ref: 00500608
CLSIDFromProgID.OLE32(?,?,00000000,0053CC40,000000FF,?,00000000,00000800,00000000,?,0053FC08,?), ref: 0050062D
_memcmp.LIBVCRUNTIME ref: 0050064E

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 86402a2162c00e796d8544b0b74d7f6e759120f2bb6931cb918a8a405fbc208d
Instruction ID: 409e4e0d44475b3c05c18f3e2b5547037faae0cadd345e344387deb875362659
Opcode Fuzzy Hash: 86402a2162c00e796d8544b0b74d7f6e759120f2bb6931cb918a8a405fbc208d
Instruction Fuzzy Hash: 6981EC75A00109EFCB04DF94C984EEEBBB9FF89315F204559E516AB290DB71AE06CF60

Function 004E1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004E14C0

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1d8ff6cc5867824e5dc56658fb044d6b4588aa14828be525d52e0843b354e3d8
Instruction ID: ea62cb21c18bb1177270362ed8e5f87fdf0252d8fe153650001eacb5cfa24a05
Opcode Fuzzy Hash: 1d8ff6cc5867824e5dc56658fb044d6b4588aa14828be525d52e0843b354e3d8
Instruction Fuzzy Hash: 62415E356805806BDB256BBB8C45FBF3AA5EF41379F14026FF418D23E2E63C4841936A

Function 00536278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 005362E2
ScreenToClient.USER32(?,?), ref: 00536315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00536382

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: eb1be309f85b1020f69d8e5585ef6cc048ebdbb9308d28216a73a70b71549794
Instruction ID: c8b61914f82661b57c8ad3913908e63df71a8dff3df0794711d4d5dcfd0d998e
Opcode Fuzzy Hash: eb1be309f85b1020f69d8e5585ef6cc048ebdbb9308d28216a73a70b71549794
Instruction Fuzzy Hash: 1B513975A00209AFCF10DF68D880AAE7FB5FB55360F10856DF9159B2A0D730ED81DB90

Function 00521AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00521AFD
WSAGetLastError.WSOCK32 ref: 00521B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00521B8A
WSAGetLastError.WSOCK32 ref: 00521B94

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 34d69ec2b3dccef979b4344cecc63523174165e09590e47d5c5b1a83ad42ff28
Instruction ID: ebe9dcf57304c920f4bd48412dc56fff0c5910e03d83efda9d836697e81f9f76
Opcode Fuzzy Hash: 34d69ec2b3dccef979b4344cecc63523174165e09590e47d5c5b1a83ad42ff28
Instruction Fuzzy Hash: 9E41F034600200AFE720AF21D886F2A7BE5AF56708F54848DF91A9F3D3D776ED418B94

Function 004DB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fce307d3892eef9d1f2e6a80f4b3498c51da49a607ce571225c248175c6cdcf4
Instruction ID: 57727fa914632972a47061e376e11aa195fdd5956f857357dafdf862e3916aff
Opcode Fuzzy Hash: fce307d3892eef9d1f2e6a80f4b3498c51da49a607ce571225c248175c6cdcf4
Instruction Fuzzy Hash: B141F175A00204FFD724DF39C852BAABBA9EB88718F11452FF141DB392D779A90187D4

Function 005156D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00515783
GetLastError.KERNEL32(?,00000000), ref: 005157A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 005157CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 005157FA

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: bd1f1505fb528b2f637adee5c0db21068975fb19bab08e7058a857f911d1375c
Instruction ID: 20814a834f0ecf944f7f6e97b20a76f8fc999f4eadec58a2988fac431a56607c
Opcode Fuzzy Hash: bd1f1505fb528b2f637adee5c0db21068975fb19bab08e7058a857f911d1375c
Instruction Fuzzy Hash: FD412F39600610DFCB11EF15C485A5EBBE2FF99354B188489E84A6B362DB34FD40CB95

Function 004DD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,004C6D71,00000000,00000000,004C82D9,?,004C82D9,?,00000001,004C6D71,?,00000001,004C82D9,004C82D9), ref: 004DD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004DD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 004DD9AB
__freea.LIBCMT ref: 004DD9B4

Part of subcall function 004D3820: RtlAllocateHeap.NTDLL(00000000,?,00571444,?,004BFDF5,?,?,004AA976,00000010,00571440,004A13FC,?,004A13C6,?,004A1129), ref: 004D3852

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 56346ac989b57a09a0185688e3e1d8d62a3b5afa2de9ec736189c60dc5b21522
Instruction ID: 0071ffddcf5bd38bedc959ed6941b4d20a34c574f891010dfbbfcaf9800acf43
Opcode Fuzzy Hash: 56346ac989b57a09a0185688e3e1d8d62a3b5afa2de9ec736189c60dc5b21522
Instruction Fuzzy Hash: AF31B1B2A00206ABDB25DF65DCA5EAF7BA5EF40310F05016AFC0496350D73ADD54DB94

Function 005352C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00535352
GetWindowLongW.USER32(?,000000F0), ref: 00535375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00535382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 005353A8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 8ed777d331ef215ce77cb2599a87524a64de49bdfa50c36232be24cf2aeded66
Instruction ID: 911be1609558ff520bad72b70336496fc0def7cef410455e4eb1f9aeb28e8d2a
Opcode Fuzzy Hash: 8ed777d331ef215ce77cb2599a87524a64de49bdfa50c36232be24cf2aeded66
Instruction Fuzzy Hash: 6631C434A55A08EFEB309E18CC06BE83F65FB04390F986D01FA11962E1E7B09D84EB41

Function 0050AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 0050ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0050AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0050AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 0050ACC6

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: e0c7272df49053a0d02ed031d9d22b9971d62ec6afbce9cb0102052acc2a3620
Instruction ID: 83fb0b828e17a3ddadf2c76c723b2cc364718f84d6f85c12292446aabe9fa4ac
Opcode Fuzzy Hash: e0c7272df49053a0d02ed031d9d22b9971d62ec6afbce9cb0102052acc2a3620
Instruction Fuzzy Hash: 1131F030A04718AFFF358B698C09BFE7FA5BB89310F09461AF485962D1C3758D8597A2

Function 00537674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0053769A
GetWindowRect.USER32(?,?), ref: 00537710
PtInRect.USER32(?,?,00538B89), ref: 00537720
MessageBeep.USER32(00000000), ref: 0053778C

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: c8e57fe9c410f2fce48c1e9afdc47ca44f934c426a402e70c90e65b2f6e3728c
Instruction ID: 9e60822a3edaeea31a605c3c334926e61175ba9022817f1a318e162bf41b8471
Opcode Fuzzy Hash: c8e57fe9c410f2fce48c1e9afdc47ca44f934c426a402e70c90e65b2f6e3728c
Instruction Fuzzy Hash: 9A41ADB4A05619EFCB22CF58D895EA97FF4FB5D310F1440A8E5149B261C330A946EF90

Function 005316DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 005316EB

Part of subcall function 00503A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00503A57
Part of subcall function 00503A3D: GetCurrentThreadId.KERNEL32 ref: 00503A5E
Part of subcall function 00503A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,005025B3), ref: 00503A65

GetCaretPos.USER32(?), ref: 005316FF
ClientToScreen.USER32(00000000,?), ref: 0053174C
GetForegroundWindow.USER32 ref: 00531752

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 968cd0041dc1ef47243b7a8887ba42c5f5f9dfcd4b4baf6d154ebb72fd3b05f3
Instruction ID: 5c86db7ce7bce6ab5dc5f1dcbbde8dc0ec27fe19d6d8b9dac0d5f04a13d4b408
Opcode Fuzzy Hash: 968cd0041dc1ef47243b7a8887ba42c5f5f9dfcd4b4baf6d154ebb72fd3b05f3
Instruction Fuzzy Hash: CD316171D00109AFCB00DFAAC881CAEBBFDFF99308B5480AAE415E7251D7359E45CBA4

Function 0050D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0050D501
Process32FirstW.KERNEL32(00000000,?), ref: 0050D50F
Process32NextW.KERNEL32(00000000,?), ref: 0050D52F
CloseHandle.KERNEL32(00000000), ref: 0050D5DC

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 777940fd05be276f01676eafd53cb178f58961d69554fd5a157df480d0de799e
Instruction ID: 5723248bc7db3aecc18b048e99b50277c4a4511e9c91e48c8bf054788fdda138
Opcode Fuzzy Hash: 777940fd05be276f01676eafd53cb178f58961d69554fd5a157df480d0de799e
Instruction Fuzzy Hash: 3A3181711083009FD300EF54CC85AAFBFF8EFAA358F14092DF581961A1EB759949DBA2

Function 00538FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 004B9BB2

GetCursorPos.USER32(?), ref: 00539001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,004F7711,?,?,?,?,?), ref: 00539016
GetCursorPos.USER32(?), ref: 0053905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,004F7711,?,?,?), ref: 00539094

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 80054f07442dfe0bdbe3a19d3965eba1a325d4b26f4eb3527cd8052f644f8cb3
Instruction ID: 62e4672d7a9e61a0ade08e0df6ba826f8d411e9710edc8a2f53cce8054b1c11d
Opcode Fuzzy Hash: 80054f07442dfe0bdbe3a19d3965eba1a325d4b26f4eb3527cd8052f644f8cb3
Instruction Fuzzy Hash: C621BF75600118EFCB2A8F98C858EEA3FB9FB49350F004059F9059B261C3719D91EB60

Function 0050D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0053CB68), ref: 0050D2FB
GetLastError.KERNEL32 ref: 0050D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0050D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0053CB68), ref: 0050D376

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 4bf6590a0b3f724ace69e6d3fc6b392d9c9d4847ae9d6ebc456dbba41ecddf03
Instruction ID: 36b445601edea7447484be29c00e881c6f880bd946067dd958cb1832e916b513
Opcode Fuzzy Hash: 4bf6590a0b3f724ace69e6d3fc6b392d9c9d4847ae9d6ebc456dbba41ecddf03
Instruction Fuzzy Hash: 5A216D745053019FC700DF68C8814AEBBE4BF66368F504E1EF499932E1D7309949CBA3

Function 00501571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00501014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0050102A
Part of subcall function 00501014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00501036
Part of subcall function 00501014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00501045
Part of subcall function 00501014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0050104C
Part of subcall function 00501014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00501062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 005015BE
_memcmp.LIBVCRUNTIME ref: 005015E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00501617
HeapFree.KERNEL32(00000000), ref: 0050161E

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 99603668f733bfaf0ebb43b9cec084670b82309bdadf344f44683df2d36f4548
Instruction ID: 9535780f260234a4dcc9b3242a23c82be4151edfc8322f14bf63981f3b2c0862
Opcode Fuzzy Hash: 99603668f733bfaf0ebb43b9cec084670b82309bdadf344f44683df2d36f4548
Instruction Fuzzy Hash: A9217A31E00509AFDF14DFA4CD49BEEBBB8FF44344F084459E441AB281E731AA45DBA5

Function 00532782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0053280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00532824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00532832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00532840

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 9dfa61d22d484cd39b34feeac5367beba1f7252cdcc07de19148c84540da0f60
Instruction ID: 37f52694ccbdf1f58e42f621a780404239adb42b978ffa6953af95a515d272b6
Opcode Fuzzy Hash: 9dfa61d22d484cd39b34feeac5367beba1f7252cdcc07de19148c84540da0f60
Instruction Fuzzy Hash: 8F21D331204A11AFD7149B24C855FAABF95FF95328F148158F4268B6E2C775FC42CBD0

Function 005078F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00508D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0050790A,?,000000FF,?,00508754,00000000,?,0000001C,?,?), ref: 00508D8C
Part of subcall function 00508D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00508DB2
Part of subcall function 00508D7D: lstrcmpiW.KERNEL32(00000000,?,0050790A,?,000000FF,?,00508754,00000000,?,0000001C,?,?), ref: 00508DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00508754,00000000,?,0000001C,?,?,00000000), ref: 00507923
lstrcpyW.KERNEL32(00000000,?), ref: 00507949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00508754,00000000,?,0000001C,?,?,00000000), ref: 00507984

Strings

cdecl, xrefs: 0050797B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 060f9ff8dab1c893b5040aa34d2db6502b3d32f132beb2b93d1e6911a8bc9daa
Instruction ID: 0e5028924fadf0d42bbb7d319972fb1e9b1f0940e1d772d15f0f637e6a190571
Opcode Fuzzy Hash: 060f9ff8dab1c893b5040aa34d2db6502b3d32f132beb2b93d1e6911a8bc9daa
Instruction Fuzzy Hash: AE11263A200306ABCB159F39CC45D7E7BA9FF99350B00442AF846C73A4EB31E811D7A1

Function 00537CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00537D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00537D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00537D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0051B7AD,00000000), ref: 00537D6B

Part of subcall function 004B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 004B9BB2

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 8893418c2d98317008296d446c45f376b43984961f1cf7dbe0800ba5e10dcb09
Instruction ID: d4721d0a749f13d5ce11605056f3ec216589c7300eaba020fcfa57ee6365419a
Opcode Fuzzy Hash: 8893418c2d98317008296d446c45f376b43984961f1cf7dbe0800ba5e10dcb09
Instruction Fuzzy Hash: B911C071914658AFCB208F28DC04AA63FA4BF49360F118B24F939D72F0D7309D51EB90

Function 00535660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 005356BB
_wcslen.LIBCMT ref: 005356CD
_wcslen.LIBCMT ref: 005356D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00535816

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: c8bd0ba32ff1f1f1f429507f3de9909c1c8552d11db67b28c1a0d2103f0b9607
Instruction ID: 87627f3cd24808e3499939ee08d636ea563296a2fde896be6a187d2175c5710d
Opcode Fuzzy Hash: c8bd0ba32ff1f1f1f429507f3de9909c1c8552d11db67b28c1a0d2103f0b9607
Instruction Fuzzy Hash: 6C110375A0061896DF20DF65DC86AEE7FACFF11764F10542AF905D6081FB70CA84CB64

Function 004D1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b20fdc12d678034c8a7528158a82e36287b78e442da74e11344ab5561b5ea5b
Instruction ID: 4e718b4a510c1aa01ffb6dabb560064a3219b7553502b100ab630a718f39a6f4
Opcode Fuzzy Hash: 4b20fdc12d678034c8a7528158a82e36287b78e442da74e11344ab5561b5ea5b
Instruction Fuzzy Hash: 1401A7F22056167EF61116797CE0F27665EDF513B8B30032BF921613E1DB689C40A178

Function 00501A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00501A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00501A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00501A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00501A8A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0505a26860a4b4bf9cc0d2fca7a8b6065912ad17420c377bc6b39624a6099fc9
Instruction ID: 5c9050c86210926bfaddd917c5918d8eb8e30c258163355c0ca4f736d888610e
Opcode Fuzzy Hash: 0505a26860a4b4bf9cc0d2fca7a8b6065912ad17420c377bc6b39624a6099fc9
Instruction Fuzzy Hash: F611F73AA01219FFEB119BA5CD85FADBB78FB08750F200091EA05B7290D6716E50DB98

Function 0050E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0050E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0050E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0050E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0050E24D

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 52712dc107d4ef8bec5781143975066b1967aff452545a83f6e4ff1ef66e0d68
Instruction ID: 9375d0840a278d7dba9735fa823610328cd58857a4e86e5b2317b8929cf2db32
Opcode Fuzzy Hash: 52712dc107d4ef8bec5781143975066b1967aff452545a83f6e4ff1ef66e0d68
Instruction Fuzzy Hash: 6E110876904215BBC7019BACAC0AA9E7FACEB55314F104A59F815E33D0D270C908A7A0

Function 004CD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,004CCFF9,00000000,00000004,00000000), ref: 004CD218
GetLastError.KERNEL32 ref: 004CD224
__dosmaperr.LIBCMT ref: 004CD22B
ResumeThread.KERNEL32(00000000), ref: 004CD249

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: e13d9ba6c6d03df9049ffb9a06ffaa6c25c69461bbf8ca8816a81b342b27a017
Instruction ID: 7edaba13e00780c20f2c6912c314f9765c4c2585327d3dec15a32ea2c10cac2e
Opcode Fuzzy Hash: e13d9ba6c6d03df9049ffb9a06ffaa6c25c69461bbf8ca8816a81b342b27a017
Instruction Fuzzy Hash: 0701003A804204BBCB605BA6DC09FAB7A69DF81334F20026FF824922D0CF79C805D7A5

Function 00539EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 004B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 004B9BB2

GetClientRect.USER32(?,?), ref: 00539F31
GetCursorPos.USER32(?), ref: 00539F3B
ScreenToClient.USER32(?,?), ref: 00539F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00539F7A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: f5eac412fe23ff69fc1d82abe6871d870baf720367e123778c6095b74b0df8cb
Instruction ID: 237ca7da02bcc62ea9fefbc10d0b9872efe2292e8a349ca8cbd02f8376c3602f
Opcode Fuzzy Hash: f5eac412fe23ff69fc1d82abe6871d870baf720367e123778c6095b74b0df8cb
Instruction Fuzzy Hash: B0117C7290011AABDB11EFA8D889DEE7FB8FF45311F004455F911E3140D770BA85DBA1

Function 004A600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 004A604C
GetStockObject.GDI32(00000011), ref: 004A6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 004A606A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 1816f87bf356122aa34fc475a40812c4871c85832c50942e7b132493c823821f
Instruction ID: 90af7a53eb53190e864d3463ece474978b84ada24e5a812e3dda27c2b2e9643e
Opcode Fuzzy Hash: 1816f87bf356122aa34fc475a40812c4871c85832c50942e7b132493c823821f
Instruction Fuzzy Hash: 0811A1B2505508BFEF128FA49C44EEB7F69EF29354F050106FA1556210C7369CA0EBA4

Function 004C3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 004C3B56

Part of subcall function 004C3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 004C3AD2
Part of subcall function 004C3AA3: ___AdjustPointer.LIBCMT ref: 004C3AED

_UnwindNestedFrames.LIBCMT ref: 004C3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 004C3B7C
CallCatchBlock.LIBVCRUNTIME ref: 004C3BA4

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 19e3afe62488ceb19499cc05b235c245ffa880d545d868d024781f7ca3ec4614
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 57016D36100148BBCF515E96CC42EEB3B7DEF88759F04801EFE0856121D33AE961DBA4

Function 004D3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,004A13C6,00000000,00000000,?,004D301A,004A13C6,00000000,00000000,00000000,?,004D328B,00000006,FlsSetValue), ref: 004D30A5
GetLastError.KERNEL32(?,004D301A,004A13C6,00000000,00000000,00000000,?,004D328B,00000006,FlsSetValue,00542290,FlsSetValue,00000000,00000364,?,004D2E46), ref: 004D30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004D301A,004A13C6,00000000,00000000,00000000,?,004D328B,00000006,FlsSetValue,00542290,FlsSetValue,00000000), ref: 004D30BF

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ede8f12d4ab94acecfb608787ba16c8ae5596b8b79db46fc48054ef093b35268
Instruction ID: aabd4f019f2db490415ad5479a7d8cf0b8713db21b8e714a17bd3defb2c7a81f
Opcode Fuzzy Hash: ede8f12d4ab94acecfb608787ba16c8ae5596b8b79db46fc48054ef093b35268
Instruction Fuzzy Hash: 87012B36301222ABCB324F78AC549577B98AF15B62B140623F905F7384C725DD05D7E5

Function 00507464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0050747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00507497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 005074AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 005074CA

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 68d26274228116e844124a344b987ca9ee9ee2d5604897347b8039f2da25ec29
Instruction ID: 48234c1e96a0a0aff718f900612b3eb4f09aadaeffdbb9afe9a85f79cb6da3d6
Opcode Fuzzy Hash: 68d26274228116e844124a344b987ca9ee9ee2d5604897347b8039f2da25ec29
Instruction Fuzzy Hash: 001184B5A053199FEB208F54DC09F967FFCFB04B04F108569A666D6191D7B0F908EB60

Function 0050B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0050ACD3,?,00008000), ref: 0050B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0050ACD3,?,00008000), ref: 0050B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0050ACD3,?,00008000), ref: 0050B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0050ACD3,?,00008000), ref: 0050B126

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: da63d9e120fcfb803507ad5e1863d7a8d113b09f141306c907e52cf4edf962fe
Instruction ID: f43954de6ed977871fdc11bd1039072b9afcd2999233f230009bcb50271c57ab
Opcode Fuzzy Hash: da63d9e120fcfb803507ad5e1863d7a8d113b09f141306c907e52cf4edf962fe
Instruction Fuzzy Hash: AA116D31C0152CE7DF00AFE5E9A8AEEBF78FF59711F104486D941B2281CB305664EB91

Function 00537E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00537E33
ScreenToClient.USER32(?,?), ref: 00537E4B
ScreenToClient.USER32(?,?), ref: 00537E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00537E8A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: bcafbd35c1c5fac19cab14b9c1e1eb219d20a73bfeb457c398324f8b83d4e696
Instruction ID: c47d0e74caf13c2426efb11fb3dc69dac2bea70e6de85e29e794ce51fc1b2439
Opcode Fuzzy Hash: bcafbd35c1c5fac19cab14b9c1e1eb219d20a73bfeb457c398324f8b83d4e696
Instruction Fuzzy Hash: 601143B9D0020EAFDB51CFA8C8849EEBBF9FB18310F505056E915E2310D735AA54DF90

Function 00502DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00502DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00502DD6
GetCurrentThreadId.KERNEL32 ref: 00502DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00502DE4

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 097a83826f070e954b040eaea6b2d4abb3a526baea9b79ebbed1f7b4a9a734bc
Instruction ID: 8d33e1e634447e37646839da92f001e1895ffce6b718fbeecb5c3aa6df1baeb0
Opcode Fuzzy Hash: 097a83826f070e954b040eaea6b2d4abb3a526baea9b79ebbed1f7b4a9a734bc
Instruction Fuzzy Hash: 8BE092B21016247BDB201B769C0EFEB3E6CFF62BA1F000015F105E11809AA0C845E7B0

Function 00538863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 004B9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 004B9693
Part of subcall function 004B9639: SelectObject.GDI32(?,00000000), ref: 004B96A2
Part of subcall function 004B9639: BeginPath.GDI32(?), ref: 004B96B9
Part of subcall function 004B9639: SelectObject.GDI32(?,00000000), ref: 004B96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00538887
LineTo.GDI32(?,?,?), ref: 00538894
EndPath.GDI32(?), ref: 005388A4
StrokePath.GDI32(?), ref: 005388B2

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: d99dcfa4e20215ed46c4fa748ea326d4bceecab8663b01ec21ed7ca19881a954
Instruction ID: 3b20442d5cd036a0ab05fdd0fb10e11a328a9e87bb7a3d33fb0e049cc565829d
Opcode Fuzzy Hash: d99dcfa4e20215ed46c4fa748ea326d4bceecab8663b01ec21ed7ca19881a954
Instruction Fuzzy Hash: 64F09A36001658BADB121F98AC0DFCE3F69AF26310F048000FB02751E2C7740566EBA9

Function 004B98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 004B98CC
SetTextColor.GDI32(?,?), ref: 004B98D6
SetBkMode.GDI32(?,00000001), ref: 004B98E9
GetStockObject.GDI32(00000005), ref: 004B98F1

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 958727ed270985df0c1bb973a90d1b6e17349530102c0186a92df04a83dc49fb
Instruction ID: 443aaad805d5d1af21c373a5cd13621c8413dadd651590a930f5667639aa3946
Opcode Fuzzy Hash: 958727ed270985df0c1bb973a90d1b6e17349530102c0186a92df04a83dc49fb
Instruction Fuzzy Hash: 5FE06531244244AADB215B74AC09BE93F10AB21335F04821AF7F6642E1C3754644EB10

Function 0050162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00501634
OpenThreadToken.ADVAPI32(00000000,?,?,?,005011D9), ref: 0050163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,005011D9), ref: 00501648
OpenProcessToken.ADVAPI32(00000000,?,?,?,005011D9), ref: 0050164F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 093ab03acb7348e30903603ee23a95b5e1d0e3ffbee112fd2e780f4383a1b0b3
Instruction ID: d5efe91cd9ff4fbbfb015a313485a325f3acf7015ce65f4081a098f7e4048347
Opcode Fuzzy Hash: 093ab03acb7348e30903603ee23a95b5e1d0e3ffbee112fd2e780f4383a1b0b3
Instruction Fuzzy Hash: 76E08C32602211EBD7201FE0AE0DB8B3F7CBF64792F148808F285E9080E7348448DB65

Function 004FD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 004FD858
GetDC.USER32(00000000), ref: 004FD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004FD882
ReleaseDC.USER32(?), ref: 004FD8A3

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 9daf12899fc412e9e4e213a591443a906eeb76c853061b6e60a061a56c1ee2a3
Instruction ID: f129274bbd6e7db1d7e2c3fcd5283e7fd029ebcfe0c7759564622daf46e307e0
Opcode Fuzzy Hash: 9daf12899fc412e9e4e213a591443a906eeb76c853061b6e60a061a56c1ee2a3
Instruction Fuzzy Hash: 43E0E5B5800204DFCB41AFA5984D66DBFB2AB18310F10804AF846A7360C7388906AF55

Function 004FD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 004FD86C
GetDC.USER32(00000000), ref: 004FD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004FD882
ReleaseDC.USER32(?), ref: 004FD8A3

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f62ac233bc2d8d815bc994d2aa93530e7725121a06c20af5b338454609a5a34d
Instruction ID: ad6c514245c903b57ef1b59546cc270cb495f9f85fb34e573c86749a72dc6beb
Opcode Fuzzy Hash: f62ac233bc2d8d815bc994d2aa93530e7725121a06c20af5b338454609a5a34d
Instruction Fuzzy Hash: 07E012B5C00200EFCB40AFA4D84D66DBFB1BB28310F108049F84AF7360CB38990AAF50

Function 00514D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 004A7620: _wcslen.LIBCMT ref: 004A7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00514ED4

Strings

*, xrefs: 00514E10
LPT, xrefs: 00514DFB

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 4911a73d46fb22dbf6f101050b07c0a85aa2440df46d1e39dc5e88459b67b46c
Instruction ID: 36a65a20b3a93545ab86ca95f936f6d09b2a099558a0d8841fed13425310b60c
Opcode Fuzzy Hash: 4911a73d46fb22dbf6f101050b07c0a85aa2440df46d1e39dc5e88459b67b46c
Instruction Fuzzy Hash: 61915E75A002049FDB14DF58C484EAABBF5BF45308F199099E80A9F3A2D735ED86CF91

Function 004CE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 004CE30D

Strings

pow, xrefs: 004CE2E5, 004CE302

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: cdf4fb59efcf2ec17438f1506c2760a4e755e14d2357c72bd03bacccbcb749b7
Instruction ID: 45b4b41e5925aeeb7807ca2c04f498ff121126dfb56d6c7c9e605a5baff77266
Opcode Fuzzy Hash: cdf4fb59efcf2ec17438f1506c2760a4e755e14d2357c72bd03bacccbcb749b7
Instruction Fuzzy Hash: 13518D69A0C20196CB157715C952BBB3B949B10744F708D9FF495423F9FB3C8C86AA4E

Function 00527771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(004F569E,00000000,?,0053CC08,?,00000000,00000000), ref: 005278DD

Part of subcall function 004A6B57: _wcslen.LIBCMT ref: 004A6B6A

CharUpperBuffW.USER32(004F569E,00000000,?,0053CC08,00000000,?,00000000,00000000), ref: 0052783B

Strings

<sV, xrefs: 005277C8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <sV
API String ID: 3544283678-1412045586
Opcode ID: 484fbfc460aadac8f981da02259d8654dfd7745612b69cc15d9b1c48f4f49689
Instruction ID: 899187c45e3e2040a2371c17e4dae5f06f11e0ddff366f3b2762b13bc967e8e7
Opcode Fuzzy Hash: 484fbfc460aadac8f981da02259d8654dfd7745612b69cc15d9b1c48f4f49689
Instruction Fuzzy Hash: 1E61827291422CAACF04FBA5DC91DFDB778BF2A304F44452AF502A3091EF385A45CBA4

Function 004BE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 004BE1B1

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 8f7aaec8504f68e44cd62453258bd9fd7e265ef9de8166f3aa3c42c1a532df5b
Instruction ID: 44632e7e6f3e0564b494622d4921408d61d46a49b7a331f92f8c40a7900ff3c6
Opcode Fuzzy Hash: 8f7aaec8504f68e44cd62453258bd9fd7e265ef9de8166f3aa3c42c1a532df5b
Instruction Fuzzy Hash: C051243550024ADFDB18EF2AC0416FA7BA4EF65311F24409BEA519B3E0D63C9D43C7A9

Function 004BF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 004BF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 004BF2BB

Strings

@, xrefs: 004BF2AF

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 7fe548b49b548bf98ed7a6eeb8ef80d5babad00ca642b774703882121b7ce072
Instruction ID: bf65c96f551f41c0d843f39aa7685733252eb6f9f3114372b4ef5695cad4d32b
Opcode Fuzzy Hash: 7fe548b49b548bf98ed7a6eeb8ef80d5babad00ca642b774703882121b7ce072
Instruction Fuzzy Hash: 775147714087449FD320AF11DC86BABBBF8FFA5304F81885EF1D9411A5EB748529CB6A

Function 00525745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 005257E0
_wcslen.LIBCMT ref: 005257EC

Strings

CALLARGARRAY, xrefs: 005257E6, 005257EB

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 7f163bdc4d98f37e4d817fd4c22043dd4ff32737edc70355b318d3c678dab378
Instruction ID: bbf2657d7e7b93e8e057491703371403dd388045f993d73541a16cb6a035758b
Opcode Fuzzy Hash: 7f163bdc4d98f37e4d817fd4c22043dd4ff32737edc70355b318d3c678dab378
Instruction Fuzzy Hash: E641AF31A001199FCB14DFA9D8859AEBFF5FF5A364F20402EE505A7291E7749D81CBA0

Function 0051D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0051D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0051D13A

Strings

|, xrefs: 0051D10B

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 6eaf2bcda5dda2a0e707028a186d35fdfff683d85ff69ef012e5d2c1a9401709
Instruction ID: 1c60f811d0d0181644e71e8111014fd8e2ddb44a73f565531bb1eae0c78896b1
Opcode Fuzzy Hash: 6eaf2bcda5dda2a0e707028a186d35fdfff683d85ff69ef012e5d2c1a9401709
Instruction Fuzzy Hash: 0A313971D00219ABDF11EFA5CC85AEFBFB9FF15304F00001AE815A6161D739AA46CB64

Function 0053356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00533621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0053365C

Strings

static, xrefs: 005335BC

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: ebb10f64481b7ef555c7c9acebba7bfabc5ba3ff2d575a9bbd251c7e4fcebfb2
Instruction ID: c998ad3adc2ca76f86ebd8111a28b9c204b2961cdecff576290e74a5a81f9634
Opcode Fuzzy Hash: ebb10f64481b7ef555c7c9acebba7bfabc5ba3ff2d575a9bbd251c7e4fcebfb2
Instruction Fuzzy Hash: 7131BC71100204AEDB20DF68DC81EFB7BA9FF98724F00861DF8A5D7280DA34AD91D760

Function 00534537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0053461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00534634

Strings

', xrefs: 0053458E

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 4034bc6a45c4895b019fb4269aa8b7fe6823ec28ae8396425c421b53dca6cb67
Instruction ID: c4cc85ff7ef4598fcb525e1e5caceeada0ffb34427b4ba578ba9bd18627366b1
Opcode Fuzzy Hash: 4034bc6a45c4895b019fb4269aa8b7fe6823ec28ae8396425c421b53dca6cb67
Instruction Fuzzy Hash: A8313674E0030A9FDB14CFA9C981BEABBB5FF09300F10406AE905AB381D770A951DF90

Function 005331EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0053327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00533287

Strings

Combobox, xrefs: 00533249

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: b98bab13de2ddff3c078119b9f0b81d0c52c83d9319f7b6f5dfaced4265b18ab
Instruction ID: 4904c9cff823fb83b59bb6601bbdac89e43270bf6ddbdd70fd729af83ee9f283
Opcode Fuzzy Hash: b98bab13de2ddff3c078119b9f0b81d0c52c83d9319f7b6f5dfaced4265b18ab
Instruction Fuzzy Hash: B211C4753002087FFF259F94DC85EBB3F6AFB98364F104229F9189B290D6719D519760

Function 00533710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 004A600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 004A604C
Part of subcall function 004A600E: GetStockObject.GDI32(00000011), ref: 004A6060
Part of subcall function 004A600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 004A606A

GetWindowRect.USER32(00000000,?), ref: 0053377A
GetSysColor.USER32(00000012), ref: 00533794

Strings

static, xrefs: 00533757

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 786f9ff2a31b37105e844dc781cd1ee72d4d4d92133bc40f6dfc543ccab83b77
Instruction ID: baf79651767c658c3b45e4968665665dfacb80a1a9d5b180a54363a0a223eada
Opcode Fuzzy Hash: 786f9ff2a31b37105e844dc781cd1ee72d4d4d92133bc40f6dfc543ccab83b77
Instruction Fuzzy Hash: FC1137B261020AAFDF00DFA8CC46EFA7BB8FB18314F014919F955E2250E735E965DB60

Function 0051CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0051CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0051CDA6

Strings

<local>, xrefs: 0051CD66

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 44e2fcd436ce0fad51602fa6b35841311545111bb3389995fcc1dcc95f92c961
Instruction ID: 33ef7326ec2905d078a014901a8ffdad61f5711caadb519ee5c2934927c509e0
Opcode Fuzzy Hash: 44e2fcd436ce0fad51602fa6b35841311545111bb3389995fcc1dcc95f92c961
Instruction Fuzzy Hash: 031106712816717AE7344B669C44EE7BE6CFF127A4F00422AB10993180D3729880D6F0

Function 00533429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 005334AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 005334BA

Strings

edit, xrefs: 0053348F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 40979a89ab09d2eb0f6071e356e887fd88cff883087a066fe2c6b3439081aef0
Instruction ID: dd1b382972fcb108f3dab821263109f8d69649494d54d31940a8fb6232ed4534
Opcode Fuzzy Hash: 40979a89ab09d2eb0f6071e356e887fd88cff883087a066fe2c6b3439081aef0
Instruction Fuzzy Hash: A4118F71100208ABEF118F64DC48ABB3F6AFB15378F504724F965971E0C775DC95A750

Function 00506C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00506CB6
_wcslen.LIBCMT ref: 00506CC2

Strings

STOP, xrefs: 00506CBC, 00506CC1

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: e17cc9151a4396ced5c19982e7a2a7eb59451fc421d4d692052464d76a16b415
Instruction ID: 9d9ce37dd45d038d1336190e24b8338c7cbf4bcd4b08c6664f911304e023dcd2
Opcode Fuzzy Hash: e17cc9151a4396ced5c19982e7a2a7eb59451fc421d4d692052464d76a16b415
Instruction Fuzzy Hash: D0010033A005278BDB20AFBEDC819BF7BA4FB61714B400929E862971D0EB35DC20C650

Function 00501CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

Part of subcall function 00503CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00503CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00501D4C

Strings

ComboBox, xrefs: 00501CEB
ListBox, xrefs: 00501D16

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: e204ba1cd676857f908134dd75d97995d476d91ec5aba05e0a96c2d4bead502a
Instruction ID: f293982367168cc48cfa70f9f5d4fab259e923d22f58f21dd7b0d79bba33c03c
Opcode Fuzzy Hash: e204ba1cd676857f908134dd75d97995d476d91ec5aba05e0a96c2d4bead502a
Instruction Fuzzy Hash: 54012832600614ABCB04EBA4CC15CFE7B68FF63394B04090EF822673D1EA345D088765

Function 00501BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

Part of subcall function 00503CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00503CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00501C46

Strings

ComboBox, xrefs: 00501BE5
ListBox, xrefs: 00501C10

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 1926c22245ab8f0eb2374fd2147f5139d5e15a81732f69fae528599af4c12e27
Instruction ID: 9c048dbc739b9ca1be6a009e7a35006915bdf225206776df23ae6f72da1a0cae
Opcode Fuzzy Hash: 1926c22245ab8f0eb2374fd2147f5139d5e15a81732f69fae528599af4c12e27
Instruction Fuzzy Hash: 6A01A77568150467DB18EB90C9569FF7BA8BF62384F14001EF406772C1EA24DE4886BA

Function 00501C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

Part of subcall function 00503CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00503CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00501CC8

Strings

ComboBox, xrefs: 00501C69
ListBox, xrefs: 00501C94

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: f79dddbbc389799ebdb37e078695481d52c117b6a5dd15cea72fa0442ed0c5a8
Instruction ID: f38c0adfaa07a43d6e1b8306cc386cd0b6461b0394694200bef91f8ccab6243d
Opcode Fuzzy Hash: f79dddbbc389799ebdb37e078695481d52c117b6a5dd15cea72fa0442ed0c5a8
Instruction Fuzzy Hash: 1801DB7168091467DB14E795CA16AFE7BACBF22384F14001AB802772C1EA24DF08C676

Function 004BA4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004BA529

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

Strings

,%W, xrefs: 004BA509
3yO, xrefs: 004BA545, 004BA54D, 004BA552

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%W$3yO
API String ID: 2551934079-1505818326
Opcode ID: bc543461afa51c682f6f20f1acbd201078d797c612deb9447a8c6720b1b02cfe
Instruction ID: f53e469ed9d6429da6c0085407bd707cb484d9d21c60f0e0999593fe3d69dcbd
Opcode Fuzzy Hash: bc543461afa51c682f6f20f1acbd201078d797c612deb9447a8c6720b1b02cfe
Instruction Fuzzy Hash: EB01473260061497C620F76AE80BFAD3794EB05714F40002FF5061B2C2DE1CAE058AAF

Function 00501D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004A9CB3: _wcslen.LIBCMT ref: 004A9CBD

Part of subcall function 00503CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00503CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00501DD3

Strings

ComboBox, xrefs: 00501D75
ListBox, xrefs: 00501DA0

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: fa6c9cdb87eec0ed026d3fee8f53701ecef7df5f5e389dd2940dba12b4a97695
Instruction ID: bf412ccb9ae13412f89a1c46b95b84b7c26180bf52ce80c4d8a1d1d37954439b
Opcode Fuzzy Hash: fa6c9cdb87eec0ed026d3fee8f53701ecef7df5f5e389dd2940dba12b4a97695
Instruction Fuzzy Hash: 10F0F472A50A1566DB04F7A4CC52AFE7B6CBF22394F04091AB822A72C1EA745D088269

Function 00538172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00573018,0057305C), ref: 005381BF
CloseHandle.KERNEL32 ref: 005381D1

Strings

\0W, xrefs: 0053818A

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0W
API String ID: 3712363035-2964257890
Opcode ID: 806ffd2868330db91f7a3f3faad87e5d4455e7f3463fa8d8ffde67ab9c1559cb
Instruction ID: 3e52303ecc5ea3dd370b0665aa9cc178f68d541cce87683614c39a6d3b9aa837
Opcode Fuzzy Hash: 806ffd2868330db91f7a3f3faad87e5d4455e7f3463fa8d8ffde67ab9c1559cb
Instruction Fuzzy Hash: 10F054B1640300BAE3106761BC49F773E5CEB15764F004425BB0CD51A1D6B98A58B3B9

Function 0052747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00527493
_wcslen.LIBCMT ref: 005274B9

Strings

3, 3, 16, 1, xrefs: 00527483

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 5ce6da662516d898fcf2dda017373aa50a9ae2554f86e56d9528ca5a7db5cb91
Instruction ID: 87d2eaac3da569ca4637e88e0eb91919e6f37e410a1040002b74ee4bb7de6b98
Opcode Fuzzy Hash: 5ce6da662516d898fcf2dda017373aa50a9ae2554f86e56d9528ca5a7db5cb91
Instruction Fuzzy Hash: D8E023467043301056B13276BDC1E7F5E89EFCF754710182FF541C2296D6548D9153E4

Function 00500B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00500B23

Strings

Error allocating memory., xrefs: 00500B1C
AutoIt, xrefs: 00500B17

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: defc370a8e07ed70edd4145a84a330a1d3614728b6812033831c60678a7d2dcd
Instruction ID: 74c5b4bf9d45d5c1fcf063fee821a9b6fa854aae5b70f3898e20ab87236866b3
Opcode Fuzzy Hash: defc370a8e07ed70edd4145a84a330a1d3614728b6812033831c60678a7d2dcd
Instruction Fuzzy Hash: 4AE0DF322843182AD21036967C03FDD7F88AF05B29F10042FFB98A55C38AE668A047BD

Function 004C0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004BF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,004C0D71,?,?,?,004A100A), ref: 004BF7CE

IsDebuggerPresent.KERNEL32(?,?,?,004A100A), ref: 004C0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,004A100A), ref: 004C0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 004C0D7F

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: a941c4d282a3f2eb31d2e52db6036fd0331b337941e6d6e184de53469fd48542
Instruction ID: e9aa9510a583e4a0a9d8cffeaeb491989c4659ca4650ccedc4df8788a7ee3714
Opcode Fuzzy Hash: a941c4d282a3f2eb31d2e52db6036fd0331b337941e6d6e184de53469fd48542
Instruction Fuzzy Hash: 7BE06D782007118BD3B09FB9E8047467FE4BB10744F00896EE886C6751DBB8E4489BA5

Function 004BE398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004BE3D5

Strings

0%W, xrefs: 004BE3B5
8%W, xrefs: 004BE3CA

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%W$8%W
API String ID: 1385522511-4035536259
Opcode ID: d5d83704f45eb0b0296ac5f539e50b143d622e33f0b70ae5c04beed2dd481f0c
Instruction ID: 1f69bc4a2ba9e81a2d14da74906e0ff0a7689039fa3f9033d733b037681f50ca
Opcode Fuzzy Hash: d5d83704f45eb0b0296ac5f539e50b143d622e33f0b70ae5c04beed2dd481f0c
Instruction Fuzzy Hash: F9E02631400910CBC604972AB854EC833D1FB8432CF1061AFE90A8F2D39B3CA882B76D

Function 00513017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0051302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00513044

Strings

aut, xrefs: 00513038

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 695369698881ee7ebfed104cf866033a8ee3894335b33bb91e5098420e9fca2d
Instruction ID: 6d0475aaa81822c6108d0e5f5560412c7521e1853b75b4eedb95e13d31cbce47
Opcode Fuzzy Hash: 695369698881ee7ebfed104cf866033a8ee3894335b33bb91e5098420e9fca2d
Instruction Fuzzy Hash: C3D05E76500328A7DA60A7A4AC0EFCB3E6CDB04750F0002A1BA95E2191DAB09988CBD0

Function 004FD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004FD220

Strings

%.3d, xrefs: 004FD22B
X64, xrefs: 004FD2A8

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 019be8ea0fefb23ae746c606edf065606ec67fc13a0352b348efd956ba905eb4
Instruction ID: 0adc0d700385d783fb646e59963dab9290fae29aa48bd804f459f7e765931eef
Opcode Fuzzy Hash: 019be8ea0fefb23ae746c606edf065606ec67fc13a0352b348efd956ba905eb4
Instruction Fuzzy Hash: 45D01271C0810CEACB5097D0DC458FAB77DBB18301F518493FA06A2040E62CD50AA7AB

Function 00532356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0053236C
PostMessageW.USER32(00000000), ref: 00532373

Part of subcall function 0050E97B: Sleep.KERNELBASE ref: 0050E9F3

Strings

Shell_TrayWnd, xrefs: 00532365

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 847552511d8cfe3aa3900a233b164f4c7dd58dd2f59c42d0b668877650cf552e
Instruction ID: 96c47b905e32137e42beff1c0e1e4dc66f68651a05fa2b8cf7bf9afe6c58e237
Opcode Fuzzy Hash: 847552511d8cfe3aa3900a233b164f4c7dd58dd2f59c42d0b668877650cf552e
Instruction Fuzzy Hash: 0AD0C9323813107AE664A7709C0FFCA7E14AB55B10F1049167645BA2D0C9A0A8059B54

Function 00532322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0053232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0053233F

Part of subcall function 0050E97B: Sleep.KERNELBASE ref: 0050E9F3

Strings

Shell_TrayWnd, xrefs: 00532325

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: d597df1ae59e608175877481543fe9481046d7806db316c7cbe7f6df2120401c
Instruction ID: a1013229b4392ea4bdb0ba0b2109e1855aaa2ae0fbe23ae92f185aa3d08b7db5
Opcode Fuzzy Hash: d597df1ae59e608175877481543fe9481046d7806db316c7cbe7f6df2120401c
Instruction Fuzzy Hash: F0D0C936394310B6E664A7709C0FFCA7E14AB51B10F1049167645BA2D0C9A0A8059B54

Function 004DBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 004DBE93
GetLastError.KERNEL32 ref: 004DBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004DBEFC

Memory Dump Source

Source File: 00000000.00000002.2895662457.00000000004A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004A0000, based on PE: true

Associated: 00000000.00000002.2895629329.00000000004A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.000000000053C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895750990.0000000000562000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895835839.000000000056C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2895859269.0000000000574000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: ac344f206efb68be4a1ddb04eb51fafc70489ed11b32acd1ce30cd0aca8de915
Instruction ID: 8f1880ff1e1f0f762143e418acedc30fd187cd05994b955909a7acdf8acf2d31
Opcode Fuzzy Hash: ac344f206efb68be4a1ddb04eb51fafc70489ed11b32acd1ce30cd0aca8de915
Instruction Fuzzy Hash: E741E435600246EFCF218F65CC68AAB7BA5EF41310F16816FF959973A1DB388C01DB99

Source: Joe Sandbox View	IP Address: 23.200.0.42 23.200.0.42
Source: Joe Sandbox View	IP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726018514&P2=404&P3=2&P4=cCm1VOkQHgylfQTH06%2f5kk5ejgQF4aFN6fpnGIsk2Vj5la5mS1D%2f51bDg3cLVdtCuhLe8QHJ%2fevbL9jub6hRJg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 5Oc92+fjJdbQg+QOuqbgXeSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.80.68

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\26e7c7ec-3e07-4c10-8c05-f70e0fc798a9.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\493ec5ff-d157-4c3f-901f-b0934646a2fa.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\50a959df-31b9-41a3-97c9-a5a2f8b922f7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5d62a90e-87f5-4650-b87a-b89177ea83c5.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6484371c-c572-41da-ae6f-8a1df0137d09.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6fba6a4f-3202-415f-af4f-3c5911979e9f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\804d53f6-b745-4033-91cc-bbcda44d2747.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\85e43001-208f-4e60-b693-b1f5d594b693.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\86eda913-e369-409e-9cf4-ea31772d590a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8d34bbeb-5c96-44cd-8bcc-4e25ad37cd58.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\4e51a93c-164c-4762-8f27-c300804b89e1.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D7B93E-1360.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D7B93F-1C20.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre