Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1503882
MD5:	437238e0e1120fa6ff1f6d4b4c1f4dd4
SHA1:	5a6fd403d8636c0f4c5d532598f85ea6c1aca592
SHA256:	a4cc4007a18e58073baef163f09a0238927ac8e7765ab861130f98e25151945c
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7320 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 437238E0E1120FA6FF1F6D4B4C1F4DD4)

msedge.exe (PID: 7336 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7576 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2076,i,6179956971381571465,2562617377228832448,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7588 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2680 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8708 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3316 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8720 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6940 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 8860 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6716 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 8884 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6716 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9152 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8124 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3224 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7420 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3848 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9432 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6032 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9456 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6032 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 9948 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 10176 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2072,i,18002439512666403320,14090865055409396734,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9560 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9792 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1996,i,7786681710576606100,13039265297249952861,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 416 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1396 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1972 --field-trial-handle=2068,i,11270960344324331106,14206124446071380624,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Length: 326Content-Type: text/html; charset=us-asciiDate: Wed, 04 Sep 2024 03:03:29 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.2aac2d17.1725419009.9cf0e41Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: *Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin: *

Source: file.exe, 00000000.00000002.2916671709.0000000001398000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.11.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.11.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.11.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 5383821d-3a3f-4f80-b8a2-0c65992af075.tmp.12.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.11.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 5383821d-3a3f-4f80-b8a2-0c65992af075.tmp.12.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.11.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: file.exe, 00000000.00000002.2916484251.0000000000BE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: content_new.js.11.dr, content.js.11.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 5383821d-3a3f-4f80-b8a2-0c65992af075.tmp.12.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49797 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0065EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0065EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0065ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0065ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_0065EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0064AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0064AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00679576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00679576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1658655242.00000000006A2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f3778b86-9
Source: file.exe, 00000000.00000000.1658655242.00000000006A2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_2b84a43a-9
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a464adc7-1
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_547d2801-3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0064D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0064D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00641201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00641201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0064E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0064E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00652046	0_2_00652046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E8060	0_2_005E8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00648298	0_2_00648298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061E4FF	0_2_0061E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061676B	0_2_0061676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00674873	0_2_00674873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005ECAF0	0_2_005ECAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060CAA0	0_2_0060CAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FCC39	0_2_005FCC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00616DD9	0_2_00616DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FB119	0_2_005FB119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E91C0	0_2_005E91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00601394	0_2_00601394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00601706	0_2_00601706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060781B	0_2_0060781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F997D	0_2_005F997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E7920	0_2_005E7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006019B0	0_2_006019B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00607A4A	0_2_00607A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00601C77	0_2_00601C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00607CA7	0_2_00607CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0066BE44	0_2_0066BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00619EEE	0_2_00619EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EBF40	0_2_005EBF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00601F32	0_2_00601F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 005FF9F2 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00600A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@98/523@22/14

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006537B5 GetLastError,FormatMessageW,

0_2_006537B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006410BF AdjustTokenPrivileges,CloseHandle,		0_2_006410BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006416C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_006416C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006551CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_006551CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0066A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0066A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0065648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0065648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005E42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_005E42A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\918475f9-f9a3-4caa-9e33-2b3b935bf4ef.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.11.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	Virustotal: Detection: 24%
Source: file.exe	ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2076,i,6179956971381571465,2562617377228832448,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2680 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3316 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6940 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6716 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6716 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3224 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3848 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6032 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6032 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2072,i,18002439512666403320,14090865055409396734,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1996,i,7786681710576606100,13039265297249952861,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1972 --field-trial-handle=2068,i,11270960344324331106,14206124446071380624,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2076,i,6179956971381571465,2562617377228832448,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2680 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3316 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6940 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6716 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6716 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3224 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3848 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6032 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6032 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2072,i,18002439512666403320,14090865055409396734,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1996,i,7786681710576606100,13039265297249952861,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1972 --field-trial-handle=2068,i,11270960344324331106,14206124446071380624,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005E42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00600A76 push ecx; ret

0_2_00600A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_005FF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00671C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00671C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-94312

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6561

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 4.1 %

Source: C:\Users\user\Desktop\file.exe TID: 7324

Thread sleep time: -65610s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6561 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0064DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006568EE FindFirstFileW,FindClose,	0_2_006568EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0065698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0065698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0064D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0064D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00659642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00659642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0065979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0065979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00659B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00659B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00655C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00655C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005E42DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-94059

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0065EAA2 BlockInput,

0_2_0065EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00612622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00612622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005E42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00604CE8 mov eax, dword ptr fs:[00000030h]

0_2_00604CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00640B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00640B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00612622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00612622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0060083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006009D5 SetUnhandledExceptionFilter,	0_2_006009D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00600C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00600C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00641201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00622BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00622BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005FF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_005FF98E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006622DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_006622DA

Source: C:\Users\user\Desktop\file.exe

0_2_00640B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00641663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00641663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00600698 cpuid

0_2_00600698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00658195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00658195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0063D27A GetUserNameW,

0_2_0063D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0061BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0061BB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_005E42DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00661204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00661204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00661806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00661806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
file.exe	24%	Virustotal	Browse
file.exe	21%	ReversingLabs
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
s-part-0029.t-0009.t-msedge.net	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://msn.com	0%	Virustotal		Browse
https://www.office.com/	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Virustotal		Browse
https://docs.google.com/	0%	Virustotal		Browse
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Virustotal		Browse
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Virustotal		Browse
https://www.google.com/favicon.ico	0%	Virustotal		Browse
https://www.office.com/Office	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.250.181.225	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
s-part-0029.t-0009.t-msedge.net	13.107.246.57	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	URL Reputation: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.11.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content_new.js.11.dr, content.js.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	5383821d-3a3f-4f80-b8a2-0c65992af075.tmp.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/passwordC:	file.exe, 00000000.00000002.2916484251.0000000000BE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.200.0.42	unknown	United States	20940	AKAMAI-ASN1EU	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.219.161.132	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.72.100	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.251.35.174	unknown	United States	15169	GOOGLEUS	false
13.107.246.57	s-part-0029.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.41.3	unknown	United States	15169	GOOGLEUS	false
172.253.115.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1503882
Start date and time:	2024-09-04 05:02:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@98/523@22/14
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 43 Number of non-executed functions: 311
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 74.125.206.84, 13.107.21.239, 204.79.197.239, 13.107.6.158, 2.19.126.145, 2.19.126.152, 142.250.186.131, 142.250.186.99, 2.23.209.182, 2.23.209.187, 2.23.209.130, 2.23.209.133, 20.103.156.88, 216.58.206.46, 93.184.221.240, 142.250.185.74, 142.250.186.170, 172.217.18.10, 142.250.185.106, 216.58.206.74, 172.217.18.106, 142.250.185.170, 142.250.186.42, 142.250.184.202, 172.217.16.202, 216.58.206.42, 142.250.184.234, 142.250.185.202, 142.250.185.138, 142.250.186.106, 142.250.186.138, 192.229.221.95, 142.250.80.99, 142.250.65.227, 142.251.32.99, 142.250.80.67, 142.251.40.163, 142.250.64.67
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, iris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-000
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:02:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
04:03:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
04:03:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
04:03:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.200.0.42	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Other.Malware-gen.18317.3179.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	malicious.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	INVCherokeebrick.html	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://bestbuy.beautybyjoulexa.com.au/citrix/fxc/bWljaGFlbHNjb2ZpZWxkQGRpc25leS5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
s-part-0029.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	13.107.246.57
	malicious.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.57
	TBIG.exe	Get hash	malicious	AveMaria, UACMe, XRed	Browse	13.107.246.57
	1RGKUwuqi0.exe	Get hash	malicious	Remcos, PureLog Stealer, XRed	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	0m4MDxiRIE.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	CODX.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	CODX.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://metaverifiedbadges.co/175261668994311/index.php?nick=YWZyaWNhbmJ1c2hjYW1wcw==&id=1526032324	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://swishmax.en.download.it/	Get hash	malicious	PureLog Stealer	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://swishmax.en.download.it/	Get hash	malicious	PureLog Stealer	Browse	152.199.21.175
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.57
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.57
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	Unknown	Browse	173.222.108.211
	file.exe	Get hash	malicious	Unknown	Browse	23.55.235.170
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	23.59.250.83
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.38
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.83.5.113
	Pensacola Country Club.pdf	Get hash	malicious	Unknown	Browse	2.16.241.17
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://850705.formstack.com/forms/23outlook	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	http://xsdrt.hanslot88gacor.com/4fBcna16686hpgN1202wmiembuhsb14569WJUNFCAXDHLQZZY1707NPBU18900N17	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	Unknown	Browse	13.107.246.51
	https://swishmax.en.download.it/	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse	52.123.224.70
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.57
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.57
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	Unknown	Browse	173.222.108.211
	file.exe	Get hash	malicious	Unknown	Browse	23.55.235.170
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	23.59.250.83
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.38
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.83.5.113
	Pensacola Country Club.pdf	Get hash	malicious	Unknown	Browse	2.16.241.17
EDGECASTUS	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://smruti-ranjan-sahoo-tech.github.io/NetflixClone	Get hash	malicious	HTMLPhisher	Browse	152.199.21.141
	https://www.dropbox.com/l/scl/AACzaw-9E1aatxpEZpO1dkWZ_aWUL6KS_-Q	Get hash	malicious	Unknown	Browse	152.195.15.58
	https://swishmax.en.download.it/	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse	152.195.19.97
	https://atpscan.global.hornetsecurity.com/index.php?atp_str=JXO3llrC97LYt_ypBDUoorYJESJf_lVgqG94Q8CbqZFSucjhJ8shDRR62UMpOfWQEisKw1UhsaXC2ei6wkJxZ78OKelMPUchf388beflwplmZ9bsAPTRZu8n2NfDqe2KOq7qiRxW9yxw4ZvRTonwJ07YfeXP0wQbvM2OFZWKje16pzGewsFyDVh5wRpEWnv0S9MgBr6GHEuMWbm1mAAXlTqLCgPJeXvAjfP8eHiPv4oozYP6pyTpRvkqdbjPLuTxQioCKIkn36kINOGd5zWy55BalBA1C-XppBzBxrZorCxNjXPTfp7EqG_ugHFutapq8UvczmG4Izo6I53rM9MZbHlXhpjq_iM6OiP6x3HRdgKt2jAlBNssK8G1	Get hash	malicious	Unknown	Browse	152.199.21.175
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	malicious.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	INVCherokeebrick.html	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://pensiuneaeladi.ro/cli	Get hash	malicious	HtmlDropper	Browse	152.199.21.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://drive.google.com/file/d/1AembzoaqYVDX_5il1daROZrPkN2ry_oJ/preview	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://sites.google.com/view/wcmb?usp=sharing	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	http://www.greenprintlandscapes.com.au	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	http://www.conchtech.com/	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	ATT.html	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://www.nyar-messenger.com/wp-content/87627428349820389/2FA.html	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://knowledgeable-expert.surge.sh/id.html/	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.589564059446264
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0af+vlRNdcolMUGy3ATkHB+l2drxUvB+PMDRliaJkX8hcSwlR5:Xq8NkC1feTlL3AiBKqSvoGlLJkOcXIq
MD5:	D6124E280DDFE63396C234C34EB88B52
SHA1:	5EC174A55CA3646BC0D2D0150FFD0F549A0DF2C9
SHA-256:	2B5782F37D3505C6261E7BDD458DD18DDA3008B1720122C5A1042D6C9F2B9B98
SHA-512:	C40163BB62FF7C6E97238E350F1DF66532017B12F376B827C1C8DC1F044FA0D183B31F59283BED6E4CA5E13BCCD221D52BFAD8476C54A2653155A6F14C79E8B4
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"policy":{"last_statistics_update":"13369892574557569"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\58281efe-723d-4e39-a55b-aa8c272d844b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.499048485921435
Encrypted:	false
SSDEEP:	96:0q8NkGS1feTlL3A58rh/cI9URoDoto1pBKqSvo5ELJkOcSSDS4S4SDScuI4a:/8NBSEreoDUuKSEtkOlb
MD5:	26247A4DCB883FB13A72C6D2FBE58E35
SHA1:	959A45BA58245465183AE079A3C8C91F40C61928
SHA-256:	F8927EF7301525F1503BAB201D5099510BC96F34386C7CB6B09B0E305CD26BA1
SHA-512:	772E86715CAE0F29F590B5A6A64F78571822579FA5D0F91ACD7577174D88D549D4C6D686C6A80492F4A93E29082BB90B0EB4D3BBF668CB9D62AD70015CB7FE87
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDr

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5bffa406-28db-40c6-98e7-85f88360d5bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20986
Entropy (8bit):	6.063320080547686
Encrypted:	false
SSDEEP:	384:7tMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS07eKh+Olif7Rp8mE2+q:xMGQ7FCYXGIgtDAWtJ4nYqw+Olo7p/z
MD5:	A5A3EE6CEF6039F3C5812C328FA3B981
SHA1:	2EF9356E9563D50E157E88B1864FB0C32E2FBAB5
SHA-256:	AED02CBECF6648291CDC7FE16E5217FAE51E27A4568C08396EBB30ACE172C5B6
SHA-512:	614E13DE1E1C7C4562E86F7E807EBA1F2192B3492C5DE2454EACBD3D5AC543B9DED2940011A2911F4AF2654DD367EED117EEFE307B3CCC92BBAE683FF62B03CE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369892576977779","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\609f04f1-22f6-48f5-9649-bbcd8f2428ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.543196691043428
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt0vlR4pGdcoiiXsHUGy3B6yik4JdXBuBuwB+aS0NhMHpXdQQRZ:YuBqDPaf+vlRNdcolMUGy3aTgBzB+UM5
MD5:	D59027EF9A71DCD46386EC280CDB9697
SHA1:	8A86B1ED272B6542E4DF92C87BF2089D1D50F29F
SHA-256:	D5E1EE69018F44F2EE51C2A0C0ACD7394BEDBE094C277104CDA8C2C6D31CA8D5
SHA-512:	6B703DD8254000758342D8209E11478B03A3009194AAD9DC05A97F7C714FC37F237E343B4466922DA10A3D334C74D6AFCDA7FB369C9FFC3F49499804CD7F140C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"profile":{"info_cache":{},"profile_counts_reported":"13369892574518589","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725418974"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6a5c29ab-4ddd-4b15-aab8-1d2d74634b05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.612285843184617
Encrypted:	false
SSDEEP:	96:0q8NkC1feTlL3AEzBKqSvo5ELJkOcSSDS4S4SDScuI4a:/8NbElKSEtkOlb
MD5:	926B81F8FBBA774F4FA7E40A466BCF36
SHA1:	5DABD9C6EAE029DF64DB612EF5857B7AB11C7E2C
SHA-256:	80D2AA05A9CA6DA0101F3C50D05F006644F28B6AE16B4DC609A29FF677258A1A
SHA-512:	F6F166363B5CBB2D83D7E04DEB679C052B21D5366BD94E4E9FF6B91617989BFB6C2BE4E53207E023791C4D73C1CF5D9EA6C67DD6B17243F76F006F72984AA951
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\81433baa-9b7b-4c48-80de-f1fde4ea0173.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20986
Entropy (8bit):	6.063366858738006
Encrypted:	false
SSDEEP:	384:7tMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS07eKh+Olif7Rp8mE2+q:xMGQ7FCYXGIgtDAWtJ4nYqw+Olo7p/z
MD5:	AD479CAE2173CA8900B451EEEC3C26CE
SHA1:	3F8CF3E9EB4175C350F74D1214957D22F4439DB2
SHA-256:	6A9D06FE6DC9E61257EF45BB80F9EC9C6F89CED5162AD70F811D57BC22C3B4B9
SHA-512:	62E2122B665E1EA648C43F5A749FDC3BBAB175A214E68E5F6971516FFFAE47DC495EC22AE57DCE4BF51207918D2F79B1B00E6C58D54583B95FC687AE27CC18AB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369892576977779","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\9b44953f-41cd-4f96-9bf6-3e61ec8f4708.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.589564059446264
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0af+vlRNdcolMUGy3ATkHB+l2drxUvB+PMDRliaJkX8hcSwlR5:Xq8NkC1feTlL3AiBKqSvoGlLJkOcXIq
MD5:	D6124E280DDFE63396C234C34EB88B52
SHA1:	5EC174A55CA3646BC0D2D0150FFD0F549A0DF2C9
SHA-256:	2B5782F37D3505C6261E7BDD458DD18DDA3008B1720122C5A1042D6C9F2B9B98
SHA-512:	C40163BB62FF7C6E97238E350F1DF66532017B12F376B827C1C8DC1F044FA0D183B31F59283BED6E4CA5E13BCCD221D52BFAD8476C54A2653155A6F14C79E8B4
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"policy":{"last_statistics_update":"13369892574557569"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\ee3242ec-ac45-4c12-b547-0ce4e8fc8055.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D7CDDE-1CA8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.040498168657505676
Encrypted:	false
SSDEEP:	192:KmUjLYiVWK+ggCdEbJtD+1X9XgLoUguELUhZvNEfbcRQM9dAnn8y08Tcm2RGOdB:/UjjlK6CoYhFuQDAn08T2RGOD
MD5:	B682DE7FEBFFA16B1BC497D7534D9B03
SHA1:	613D72BF248A6CE45C7A11CEEBFCC4DECBED6AE3
SHA-256:	46BDA27E9A6F241514E0670391C82B0E69A64DE2D99A6EFB6F279E5E903BDC09
SHA-512:	68DEE3A60BF322A26B6146000D5C2AB6141A6CCE742DB21248C9C09236E790BA251C0614B8B2A65C632C8432181B4D96F3AE6FC8F5E038456DE5B7D6A44F67B9
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".poeqfm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@.............(.....................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...;.O..&T@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D7CDDE-1DA4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45683902180375047
Encrypted:	false
SSDEEP:	3072:o2oJ214fHIlmWPYaSEyMeGhuliLffnuNodXi31g1HFwVRXLR7Oa/hfqQ2+NhffzU:lx4DJWi31aHenPWOL/aHtJimz
MD5:	F5652720B8B2CD48DBB47EB91EA2E8EF
SHA1:	769FF1435F39A974DCDE0E8FE17646831A3941CB
SHA-256:	F859FDAA290D16CE8D5101FBF88B42E6CBCDB355FD91BC86B7FFC9B32E164B3E
SHA-512:	4B6BB629D62F722A73D3B8E8C6B06B4CF22F5F1960B72AB4CA7652B127A2F22FFCFFEE1BA64152A8BF475CA29D4A4816DCF799DBE6B79617A109D5592F7762E0
Malicious:	false
Preview:	...@..@...@.....C.].....@................V...V..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".poeqfm20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.160498086267537
Encrypted:	false
SSDEEP:	3:FiWWltltodnkIHSRqOFhJXI2EyBl+BVP/Sh/Jzv+VoAxIIxk9cttl:o1alTyRqsx+BVsJD+GAx1xk0X
MD5:	65643378C926589356C10437FAB77223
SHA1:	3B5826AEADE37F05363D97CE0F6E1D85FC4D40BC
SHA-256:	4E43598BCFBD027419BFEF4F7963E416E31A27457C201525C704DEDF99F43DBA
SHA-512:	82954612EC2871B663738D528B71BDACAC333C9C53DFD35B905A7B760FC26BE0A81267BCB365EA7BFE7A30D76EE21006982C1BA8692B950CFE83A07133DD741E
Malicious:	false
Preview:	sdPC.......................T..B..(.f..."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................1404de13-cda3-426a-9e75-84aed94da00f............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0ceb2194-f25d-4cfb-95b3-75131457d82b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566247519676348
Encrypted:	false
SSDEEP:	768:fZqdBCWPR1f0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0pTOerwjgpGtug:fZqdBCWPR1f0Tu1ja51O7dtL
MD5:	766CC5D810E216D7A010C279EE6F1D57
SHA1:	4AE520EC3E7C300C762D72834AC21710419DE6C8
SHA-256:	0278BB3A0B3E76F5A07B3F3CC14D31A6F01569E7D1342029DBF3C62B93C4BDF1
SHA-512:	C10814E593025F4E35FCB6E812AB1B70450B60AE05CD56A6EBAC6A15DC0134D2658B7F8D956922850337F253A9C789B44271A9A2EEE2A73785A4C49B5E03EBA9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369892575125972","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369892575125972","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1de9c5b7-bc10-4728-814e-c4ea913a4fe9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\288a47aa-de89-410d-b457-f02f7892bd8c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.5663025724476345
Encrypted:	false
SSDEEP:	768:fZqdBCWPR1f/T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0pTOerwjdpGtu7:fZqdBCWPR1f/Tu1ja51O7Otc
MD5:	5C12A95E34ED740DB6FABB3AF1B769CF
SHA1:	11D3A62D60C9D0487FB817390C737AF940782618
SHA-256:	37DF2C216B9A2C3F2C03C6A23E976C62A7F71127419533D554A8D152A3878414
SHA-512:	1E274F2F1CED8744466F05F927315CF9D17816BB56B4267914049C56CA98F5B9C3805292F6C6D28C30C5F9F70B4CC70E792B95842A640FEFF04E9216B8027AD0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369892575125972","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369892575125972","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\2996736e-5036-4fcd-bd3d-35273d739984.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.978860905792723
Encrypted:	false
SSDEEP:	96:stlqfXis13b9Yy9KN8zEfIs85eh6Cb7/x+6MhmuecmAelSVQ82Mu/EJ:stl5sZKNkEfIs88bV+FiAFPuMJ
MD5:	A6B44C5898F1A948CAA3E5ED7DB904AC
SHA1:	F957B2232666BB7EABDDE79476261D4E4B71D14D
SHA-256:	A366CAF47415B0A64EB2147125A88603BE1B1220D51403BF9839B1732C0066B1
SHA-512:	9649CA8995091567F91A3AA308C166ADAC5F7B51A1B927F550F09A968289D4021D7579F1A2AC3398728808511E25753320DA74681078F7365089C020D1DD460D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369892575706802","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369892576935425"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\40f0fa41-2476-4895-8c85-bba2c32c9b91.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\8a36514a-ec0e-40cf-a0c0-f00fcc91d288.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.980614477816849
Encrypted:	false
SSDEEP:	96:stlqfXis13b9Yy9KN8zEfIs85eh6Cb7/x+6MhmuecmAelSoQ82Mu/EJ:stl5sZKNkEfIs88bV+FiACPuMJ
MD5:	BE95B559DECED7AB911C4E120D0D7A74
SHA1:	85C18FE2D0DC4C6445FC8D04A5733386163195B8
SHA-256:	9FDB9792C662E6D94EE267EF957BA7C16EDE3DB07413517E579DAF690D7072D2
SHA-512:	E048823A351A71FFD1D3D354EA98A61C2AD4B427A3E95AAA3CBF5F5411587F60756FE6DE3CE24DE41EC765F7E2F8C85BF069E08696DF2117465876D08FECC3F1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369892575706802","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369892576935425"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.3207516314090295
Encrypted:	false
SSDEEP:	192:IAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:rOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	A749BCFF6B5DA617961F1E61538ED205
SHA1:	B7B19F840136673BEC74FB83B157DEBF805FEE09
SHA-256:	22E7BE3ADC74336CDACDFB5CAD6CFEC89DDD02FFAB4CEC305765B5B531D5EFB3
SHA-512:	E4FA6DE4F796659CAAB2E40110B85C1138EF8FCFF5DF67CC142773F04198B86D8E666788CBCEC24ADC3D801EC5248A8ACAA41583FAEB4F3D846FF7ACA1B74FC4
Malicious:	false
Preview:	...m.................DB_VERSION.1)..N.................QUERY_TIMESTAMP:arbitration_priority_list4...13369892580614239.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.09751175419926
Encrypted:	false
SSDEEP:	6:PD7d5hq1wkn23oH+TcwtOEh1ZB2KLllD77TOq2Pwkn23oH+TcwtOEh1tIFUv:PVb1fYebOEh1ZFLnuvYfYebOEh16FUv
MD5:	4C60FA1E1C78DA28011F8E00620F7995
SHA1:	C31CF4F0EF4CB80F07830D5BDFCC9C717F54D303
SHA-256:	3BE8A33CCA243215535DC6792CEC017536284078DB748E0045747667E00F68CE
SHA-512:	46E81D28ECC1CD35433EA5873AFD6B483B2CD5A03FCEF29A244704BAE15D0F6C93A262770B938164574B5C15440F6C05A2B7357AA31DBAAE9B7CA8CCF9A6A021
Malicious:	false
Preview:	2024/09/03-23:02:59.823 2240 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/09/03-23:02:59.905 2240 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.0442731819608328
Encrypted:	false
SSDEEP:	6:/Fii2nBv7tlUkM/lX48WClaQ9ardta9giWfRll5/lvX:dkBv7tEoJrr/a9giW5/zvX
MD5:	A29DF921448D72D5B07031C9A2D4CF1C
SHA1:	0BEB77081B45DB1EDE8930EE436C13CA35C3A213
SHA-256:	9563B6ADF0B0D27657ADCE69645FB50711D81650ABED62B47A6D642452B7BE04
SHA-512:	06BD48BF2229A1ADC4F0FE7F738E8C5F711C5D48CF3D9B94C97A476C0AF1C298EF048DDB30BF17340B71AC74186CFFC096149B1A92EAA48C132CC784859E428D
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09579317435382244
Encrypted:	false
SSDEEP:	48:6V4Xesx1V4A3es3NUeG6W2A9+hT3lWp4:6V4X3TV4A333NLGj2AoF3L
MD5:	050ACC9E6B50091D8B516FB7DB1DB7A1
SHA1:	F1459D1C90F63FC3466489FF5563950B276DF3CE
SHA-256:	4E0F246C0A76058441DECEE5EF7B96E870B44DF1178BDB7579EAEC840431293D
SHA-512:	87A2332A714B53199E667F3F8E53891D8F495FC0E8699EFCC8E79CBB6D6A3D5A34C00E1F90EF93EF493404DCA312003B1AFC78E63FE58B6C86E64CB185ECA62D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.2830309026865349
Encrypted:	false
SSDEEP:	384:JaZZJtMpZZJtMBArnQe2VJtdprnQe2VJtdwaIdaJtL:JaLJtiLJtvUJtFUJt8daJt
MD5:	83703C69FDDE7A758FE9899EE4C82532
SHA1:	80FC197A3B9A4F3608136BADCF89D12A086E80A0
SHA-256:	692088E0144C2EB05E5895E28D6C9021028A512BBBCED2FF2FBC149DD4EBE85C
SHA-512:	3DF6DDBE507E3FCDC3BA9076D59ECF6A81ADFD969082A2F3A6229A11D69DB4D039B3AC49681D27AB99242AFC932E647438F40A4FD254835EDBBCF68234DEFF1D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:Lsulgpll:Lsrl
MD5:	B2E4233EC8858B873DCA3FCE7BED6BDF
SHA1:	FFD4B8515F3E21C645D23DA890C2E02D9CCF94DD
SHA-256:	28F553CE45F2178EB6FE332EC71E0876BEE69EDDFF870804B8A626B0ED0D9ADF
SHA-512:	E8681BDAA19D23D536944A47795E28DD5F6870F4A3F08BB2F5706B3953781EDF90288A263EFBB98966E16EC04ED6958E35E09D19CA357495DCCD8BD2FF12CA2D
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:deDZc9EhZTKl:cDZ1hN+
MD5:	4E70100E0FA54826EFE73688F3E49BF6
SHA1:	77477BA42A0383FD7866C1FDF7629BC7AA00D8E2
SHA-256:	383593B207AED0263977AEC68D6372EFC814E7F7C0413E1CE75A524AE5040854
SHA-512:	65E79469EC2A875791DA0440791E6AB2BED94589E48A6BD9DFB6FA3E9A877B85065A4C9A146213F03646ADEAB3A2FD4A2B0FF0283639FE052426330935717AA4
Malicious:	false
Preview:	(...@;&.oy retne........................=...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:deDZc9EhZTKl:cDZ1hN+
MD5:	4E70100E0FA54826EFE73688F3E49BF6
SHA1:	77477BA42A0383FD7866C1FDF7629BC7AA00D8E2
SHA-256:	383593B207AED0263977AEC68D6372EFC814E7F7C0413E1CE75A524AE5040854
SHA-512:	65E79469EC2A875791DA0440791E6AB2BED94589E48A6BD9DFB6FA3E9A877B85065A4C9A146213F03646ADEAB3A2FD4A2B0FF0283639FE052426330935717AA4
Malicious:	false
Preview:	(...@;&.oy retne........................=...../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:rmjqyEbI4+n:yjybmn
MD5:	8E28972B270CE76B7FEEE1A1F21AE265
SHA1:	4F55F8FED9AD7A5DC39728D9FDF50A11F8291DD1
SHA-256:	7E74416CC7F12237E37C8B4303A55292858F4D4282E626E47D0ADEC3EEF0778C
SHA-512:	AC8A7D0038A6905F78C98566B545B430C725C8EAC19A885E45842D426CD0364A8C284E199BE4D21F101F8C32700885188D09546711379CFA39EA4E5AA105DF43
Malicious:	false
Preview:	(.....F.oy retne........................G8..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:rmjqyEbI4+n:yjybmn
MD5:	8E28972B270CE76B7FEEE1A1F21AE265
SHA1:	4F55F8FED9AD7A5DC39728D9FDF50A11F8291DD1
SHA-256:	7E74416CC7F12237E37C8B4303A55292858F4D4282E626E47D0ADEC3EEF0778C
SHA-512:	AC8A7D0038A6905F78C98566B545B430C725C8EAC19A885E45842D426CD0364A8C284E199BE4D21F101F8C32700885188D09546711379CFA39EA4E5AA105DF43
Malicious:	false
Preview:	(.....F.oy retne........................G8..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlfkBtl:Ls3sBtl
MD5:	AF3108A7C6E1D261179F59D7427ABF74
SHA1:	1D4056F8072E015371763A2E5107840B0182DE45
SHA-256:	402FB01FE8CE72AE5E1140158451150AB7284CC3AEB5BC32E1020C6D4CB1291E
SHA-512:	FD5EF6E07A42F704A29730138D5D4C473CF96F9B5FEEC76F59FA6C642135B8B10802B0BFF6D48662B50FF647E286950DEB0F27FE9A83EDA4A23E8C83A3043F9A
Malicious:	false
Preview:	.........................................v..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354102721526915
Encrypted:	false
SSDEEP:	6144:rA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:rFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	BAF41CE2279754337AAA4F4D674E0502
SHA1:	C58142BB81D6F22A073FF0C85E90BBF1E8D1E254
SHA-256:	801BAFCBE01E8117715C8407C374B27BF17F16802418D0CE144B6223507CB619
SHA-512:	7D9D75F644E8A3FF74F6C424AA923D3724FB18DB4FA21EE373552FC556916186465F986C6C3FCE2E6FEFF8B83124D9132EA95A15E1E61D8FFB50AC75D1086B47
Malicious:	false
Preview:	...m.................DB_VERSION.1RWO.q...............&QUERY_TIMESTAMP:domains_config_gz2...13369892580584812..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.190073949785107
Encrypted:	false
SSDEEP:	6:PD71u1wkn23oH+Tcwtj2WwnvB2KLllD7d1vAVq2Pwkn23oH+Tcwtj2WwnvIFUv:PN5fYebjxwnvFLnVF4vYfYebjxwnQFUv
MD5:	E804203A1B6562FE15BF594430C5FFB1
SHA1:	C9A43EBF944C299A5B5031BFDDD0F02771E3CB1C
SHA-256:	16C88E1402B245D71928DC89CA2A174BA720611D10086D054144B6CC85B60172
SHA-512:	8A8FF12C2D89447EAA5FC77BE24591DCD8E4F1B87BF09B03D22897FB59B2771D1BE72F6D6384E12C81F66AAA38BB431A580F7A279B533EE93654786251AC6E96
Malicious:	false
Preview:	2024/09/03-23:02:59.792 2230 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/09/03-23:02:59.885 2230 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324617315342663
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R6:C1gAg1zfvi
MD5:	D190009A136821C9A1DAB773AA9A1F78
SHA1:	7B91A3E6BD1EF6835FC5A2C603E81899929ACB88
SHA-256:	EE5D557C6B614EB7C0DCF127EB33B6C0B49F6BE20752CAFDE43A414C2BC580A3
SHA-512:	C5799267577528685AF5C7FFCB095F08E40280CDC08901669414A87EFEB6FB3FDAEB1E8777BAEACF1A52C6B85947AD0624B5F5D4DC46317B3E1ED029BA01F24D
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.199782266747392
Encrypted:	false
SSDEEP:	6:PDPvj1wkn23oH+TcwttaVdg2KLllDPHUN+q2Pwkn23oH+TcwttaPrqIFUv:PLSfYebDLnRvYfYeb83FUv
MD5:	172EA19F37836220C8820AE21D6EED8E
SHA1:	5E563E5B6718A0BDAE0E815A70B09CC20A3F73A3
SHA-256:	4CCC2939634B4BFE03610E8755F477E3C53D4B020806B51A45D16CDE4D2AD621
SHA-512:	EE5CEF046DCB1DA9BBABB2C16B84353D426F6868815816CABB57E9BB27760E74A83653BAD078BC00A9D8409DF26C88407C58A5473338C810DDD26DE77E71450F
Malicious:	false
Preview:	2024/09/03-23:02:55.212 1e78 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/09/03-23:02:55.383 1e78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.21830513554025
Encrypted:	false
SSDEEP:	6:PDPbLS1wkn23oH+Tcwtt6FB2KLllDPjud+q2Pwkn23oH+Tcwtt65IFUv:PjtfYeb8FFLnHTvYfYeb8WFUv
MD5:	1AF59C4C64FA8DDD1557034D85265877
SHA1:	E20B11B67F59C34CDB62212EB516041529D97AC9
SHA-256:	9937EAC25F76EBE1FD2A744233AC6677842BDEA36AF3BD2E03EF811183BC0CA8
SHA-512:	B8222CEB25A5427EE4E47688BAEB70AEE380B944725DDF8718AF40242205E57FC2A6674068C52F3C74DD6C7ABC6C626A573B68C3C091D661AB5952AD01A252ED
Malicious:	false
Preview:	2024/09/03-23:02:55.396 1e78 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/09/03-23:02:55.446 1e78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.19527538437093
Encrypted:	false
SSDEEP:	6:PDVZDmRq1wkn23oH+TcwttYg2KLllDVA3+q2Pwkn23oH+TcwttNIFUv:PxZDyfYebJLnxAOvYfYeb0FUv
MD5:	8DA44FD77D87D4BFE4EC66AE79B740F9
SHA1:	E5C29330BB3DD276AC57785E6E93A2E327E15EC1
SHA-256:	CC652977F85CDB77A1E43BC8EB39FFB2257C60D37C79997B9B9CEABD026DF500
SHA-512:	AEEE3AC0E16CC66B99E3E130FD030156C2B6ED22F86BBB9730CC4FA49B36013BBD9BA95DEE513E033C3A6E5F0E847AA047F9D6832B74A776FA3CD20056D502EA
Malicious:	false
Preview:	2024/09/03-23:02:57.166 1e38 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/09/03-23:02:57.181 1e38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlSll:Ls3Wl
MD5:	1A33CF82D5D042307C42880254F08F8A
SHA1:	333279E34FE58FF5DD0A0B82927843D88BBA0412
SHA-256:	D2606CA43031EDB3A6299FFCEAC300D1F511D217563237334865DE8C7C4EAE3B
SHA-512:	4C0FCEA415FEDE25196B64DB38CC35BE417827D7A3BB6ED3D50EFFD879892DA16D6264D2ABDB0997A708E30552191A6AD772044C85F24967A06F9FEC0DB3F969
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:biZtFlljq7A/mhWJFuQ3yy7IOWU7dweytllrE9SFcTp4AGbNCV9RUIV:J75fOxd0Xi99pEYb
MD5:	3EED555FA39DBE5A8735647026D6D8FF
SHA1:	F60BD6DAC9F5C7D0E1C84A1EAF13F89A062C67E4
SHA-256:	C3CF1DE5DCEA7AD48972083DDFB5965BB48A71F0070994C56FAE525042202B15
SHA-512:	60F4B32085D1F52C782964F02E96EDB6821B19A7672B0EACA96398307E5BEE48CD1839166BE8FD1B31AC25D4DB8503BC28AADC8D1D5A4E11129D015C5B8BC2F8
Malicious:	false
Preview:	.............Yg....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.216935696000039
Encrypted:	false
SSDEEP:	6:PD2M1wkn23oH+TcwtRage8Y55HEZzXELIx2KLllD2BZfq2Pwkn23oH+TcwtRages:PIfYebRrcHEZrEkVLnIfvYfYebRrcHEz
MD5:	B4E832523C1D800512EFF5F6A4A01974
SHA1:	711AA8BFC1C3BFEAE8C034A9CE723B07C489344C
SHA-256:	47672DC0B69CB451ABFF452FDD05089C884FD93578AC66B59E5D4108690E8A9D
SHA-512:	60D6BB791EC52E9CFF4B5BF8D652026DA6E84E7E3E66B570E8294CFA6AD261AFEB6F4DED90080B3323BDF040C36245BAD490F5DF0D68BC5A465842CE8515C724
Malicious:	false
Preview:	2024/09/03-23:02:58.088 1e30 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/09/03-23:02:58.118 1e30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.218868160205676
Encrypted:	false
SSDEEP:	6:PDPdB1wkn23oH+TcwtRa2jM8B2KLllDPQ9+q2Pwkn23oH+TcwtRa2jMGIFUv:PhkfYebRjFLnE4vYfYebREFUv
MD5:	01C650689B31B454ADB7B38F83721493
SHA1:	9F172A4AF64E26AD47547D4A0533E51C4B7AFFC4
SHA-256:	01625904A7CE53FDAD2AEED5B98D5FCFDE2218547CB3FF3D4F3CBDA6574089F7
SHA-512:	7376100C8809039EE139CF593E9C17874775A43934C8718BA2B5A0AFA24160DD8D522A477E454E254DC090D5935EBE931AEC58DD14DC06C4042A6E794942AC65
Malicious:	false
Preview:	2024/09/03-23:02:55.560 1f28 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/09/03-23:02:55.583 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\1c22bc86-4f5c-4c23-b807-c9845ef786b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.89042451592505
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDHERW6JfYoR6oJbRHeHBYMKWKWMS7PMVKJq0nMb1KKtiVY:YHpo03h6ubIa4MS7PMVKJTnMRK3VY
MD5:	633DDD1B4920EC5BE074DBE9C025C0CA
SHA1:	544DEC5ED8BD3FBAB234940BEA45390B5CEF13D1
SHA-256:	8FCAE56F81D49DE83AC45BB8848E818C99462EEE03D017124E895D39630B3889
SHA-512:	CB89ABA6C2D59A7D520BD1BBDB85CBDF5CFBBE3DC9DFD02E06071F8597E3EB0D3B3BE3587AE58870B92127379A2C875A856F11B6792D4A68C5204837814549A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\4607405a-eea4-4edf-a0e2-96bddf29f670.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\480d4795-8a0f-4623-b2d9-2a107a281074.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3b94e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7612151485922486
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkhG:uIEumQv8m1ccnvS6J
MD5:	7D99A7E77A62F95F5F638CDDA9C02F91
SHA1:	338F25C2298A679D76F131685E98951B5A069C74
SHA-256:	B5F6C16F367028554128182E41FDE2D5DC72E096393F29859AC8E25EB164835F
SHA-512:	E4AB2E77716F89BA6D25B5875D5E948B4EA8176E0347C1E3C2359DDCDA0EB3EBB867BFEAD0AD71CA9FCBC668F71C789160AAF02AE3DDB56CA25989CBA9372447
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF29810.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\a8b64b8e-9f2e-49a5-bea9-33530d153dcf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\ec555d5d-3ac0-4a2c-9689-bb1e74deb95c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.972077578144019
Encrypted:	false
SSDEEP:	96:stlqfXis13b9Yy9KN8zEfIs85eh6Cb7/x+6MhmuecmAelSX82Mu/EJ:stl5sZKNkEfIs88bV+FiAcPuMJ
MD5:	3E5DD75C9196D2D07DA732914810F102
SHA1:	4032E870C5F9E41785DA79222BA60877E69AF864
SHA-256:	FF879DB28AF5B303DFE7A98BAE0D829CFB79F85B26B6CD8A86A0FB4961084124
SHA-512:	1BA8CC762EAE182D410FB9636780E20EAD70F075C9BCE4AA192FAAF7C5A17E52F8E354173EE97511E7315CC90D5A7B6A5388395405C2B32FE3CF38E1B02C8485
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369892575706802","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369892576935425"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF32730.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.972077578144019
Encrypted:	false
SSDEEP:	96:stlqfXis13b9Yy9KN8zEfIs85eh6Cb7/x+6MhmuecmAelSX82Mu/EJ:stl5sZKNkEfIs88bV+FiAcPuMJ
MD5:	3E5DD75C9196D2D07DA732914810F102
SHA1:	4032E870C5F9E41785DA79222BA60877E69AF864
SHA-256:	FF879DB28AF5B303DFE7A98BAE0D829CFB79F85B26B6CD8A86A0FB4961084124
SHA-512:	1BA8CC762EAE182D410FB9636780E20EAD70F075C9BCE4AA192FAAF7C5A17E52F8E354173EE97511E7315CC90D5A7B6A5388395405C2B32FE3CF38E1B02C8485
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369892575706802","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369892576935425"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF39c70.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.972077578144019
Encrypted:	false
SSDEEP:	96:stlqfXis13b9Yy9KN8zEfIs85eh6Cb7/x+6MhmuecmAelSX82Mu/EJ:stl5sZKNkEfIs88bV+FiAcPuMJ
MD5:	3E5DD75C9196D2D07DA732914810F102
SHA1:	4032E870C5F9E41785DA79222BA60877E69AF864
SHA-256:	FF879DB28AF5B303DFE7A98BAE0D829CFB79F85B26B6CD8A86A0FB4961084124
SHA-512:	1BA8CC762EAE182D410FB9636780E20EAD70F075C9BCE4AA192FAAF7C5A17E52F8E354173EE97511E7315CC90D5A7B6A5388395405C2B32FE3CF38E1B02C8485
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369892575706802","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369892576935425"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566247519676348
Encrypted:	false
SSDEEP:	768:fZqdBCWPR1f0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0pTOerwjgpGtug:fZqdBCWPR1f0Tu1ja51O7dtL
MD5:	766CC5D810E216D7A010C279EE6F1D57
SHA1:	4AE520EC3E7C300C762D72834AC21710419DE6C8
SHA-256:	0278BB3A0B3E76F5A07B3F3CC14D31A6F01569E7D1342029DBF3C62B93C4BDF1
SHA-512:	C10814E593025F4E35FCB6E812AB1B70450B60AE05CD56A6EBAC6A15DC0134D2658B7F8D956922850337F253A9C789B44271A9A2EEE2A73785A4C49B5E03EBA9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369892575125972","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369892575125972","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2f7e3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566247519676348
Encrypted:	false
SSDEEP:	768:fZqdBCWPR1f0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0pTOerwjgpGtug:fZqdBCWPR1f0Tu1ja51O7dtL
MD5:	766CC5D810E216D7A010C279EE6F1D57
SHA1:	4AE520EC3E7C300C762D72834AC21710419DE6C8
SHA-256:	0278BB3A0B3E76F5A07B3F3CC14D31A6F01569E7D1342029DBF3C62B93C4BDF1
SHA-512:	C10814E593025F4E35FCB6E812AB1B70450B60AE05CD56A6EBAC6A15DC0134D2658B7F8D956922850337F253A9C789B44271A9A2EEE2A73785A4C49B5E03EBA9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369892575125972","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369892575125972","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.1444512543617
Encrypted:	false
SSDEEP:	6:PDTlB1wkn23oH+TcwtSQM72KLllDjt+q2Pwkn23oH+TcwtSQMxIFUv:P/lkfYeb0LnvovYfYebrFUv
MD5:	8E18A88231BB0932BFFFA300D1E04108
SHA1:	9853FCAFA0AC256FBCE084F1EC8E6DCEAFED4CDC
SHA-256:	A5F2529123ED15B092E6072690B1EC4EA322C520E3F30472D5DB748DD3B5E987
SHA-512:	F66305684E334697BAABDA5A2D259A3AB3514E0EC56D81CC78A67ACAE6187F41E4F106DB97ED46FF26ED1A631DDEBEA9B7721C4D5D61F256E35427E332F842BD
Malicious:	false
Preview:	2024/09/03-23:03:12.919 1f28 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/09/03-23:03:12.955 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.119407686048079
Encrypted:	false
SSDEEP:	6:PDPL/1R1wkn23oH+TcwtgUh2gr52KLllDPX5SGSQ+q2Pwkn23oH+TcwtgUh2ghZh:P90fYeb3hHJLneQ+vYfYeb3hHh2FUv
MD5:	7A827019AAE668494ED1B0934CE76AC8
SHA1:	9569BACF01557B9C243A59E243891C7805784B74
SHA-256:	CF934CEA5F39207B607EFD703BC30D245C243F747AE04E6E7A284967DB8A9450
SHA-512:	D2EC61D41B919DC917640E531C150448568CAEBE8EF3DEC082AF2E3EDC8827139F590C69B2E910D764D382263DCAA958586D5A623FC4FAE7A12724BE0FBACE2F
Malicious:	false
Preview:	2024/09/03-23:02:55.172 1e7c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/09/03-23:02:55.358 1e7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulqaKX:Lsz
MD5:	0F539926B46C8D0ACA741CD4F9A1643A
SHA1:	BB13FB2A86E7F954B7BD03ECC533C8B7B03E4BB9
SHA-256:	33E9F4DA0F12251AD409D0A2D74D46316AD209B4300FF62397A257E48898C239
SHA-512:	8CDD43581CCDBC8FD1BE2EC10F69AFEDEFDFF1F72D3606F46E44B1521E7685FA0EEAD6C40CF514D86C4F836286DF745C134CF78870B6C8422FE3F5CC22A63716
Malicious:	false
Preview:	........................................db..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:H82jEr/U9Tn:cDrMTn
MD5:	8EAA893B0F0C8BB7D178269E82354461
SHA1:	43842CEE1A9B6753B5A62B21B2CA8F39787ACCAA
SHA-256:	67ECBBA27EE2A613BA7860C9F4A9629272F1AE0AC6166BFB51226F3DBCD7A5B7
SHA-512:	0FEE6796DB7B92715FD128816972B3A0633492350BB017F01A710E73C3943D8E3E938C0A4465884BCDB6D2AA1FB24D9682DF48FF736400AF26C76ABAED9099FD
Malicious:	false
Preview:	(.....O.oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:H82jEr/U9Tn:cDrMTn
MD5:	8EAA893B0F0C8BB7D178269E82354461
SHA1:	43842CEE1A9B6753B5A62B21B2CA8F39787ACCAA
SHA-256:	67ECBBA27EE2A613BA7860C9F4A9629272F1AE0AC6166BFB51226F3DBCD7A5B7
SHA-512:	0FEE6796DB7B92715FD128816972B3A0633492350BB017F01A710E73C3943D8E3E938C0A4465884BCDB6D2AA1FB24D9682DF48FF736400AF26C76ABAED9099FD
Malicious:	false
Preview:	(.....O.oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:RXL0XTEOaGl:ogLGl
MD5:	738DE8F59EA24587F6495EDC4EA65297
SHA1:	186F40389578DD822124CF243577BE759CAF1215
SHA-256:	1B738F4FD8D4EA7168506160056631CE638D4EF8BC9B16AE395DF085E995D5F9
SHA-512:	57B6CA70372C1418FAA8EC800C8725740458FAD60D36FA94AD64F716C7796294EFBDD42687CEA7F7BE1075355E32D7C6B69F9991D1906A9452C8CF7E8B6AF8DE
Malicious:	false
Preview:	(....2D?oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:RXL0XTEOaGl:ogLGl
MD5:	738DE8F59EA24587F6495EDC4EA65297
SHA1:	186F40389578DD822124CF243577BE759CAF1215
SHA-256:	1B738F4FD8D4EA7168506160056631CE638D4EF8BC9B16AE395DF085E995D5F9
SHA-512:	57B6CA70372C1418FAA8EC800C8725740458FAD60D36FA94AD64F716C7796294EFBDD42687CEA7F7BE1075355E32D7C6B69F9991D1906A9452C8CF7E8B6AF8DE
Malicious:	false
Preview:	(....2D?oy retne............................../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNliKtl:Ls3ptl
MD5:	917E037CFAAB0E054D5207C05C57498A
SHA1:	1BC4C144CF296526DFD8F067847D7D33A62D819D
SHA-256:	14CB826EFD07BC412843EC2D05F94AB4B0F0B4A4B701D09EF78421483D9EEBFB
SHA-512:	527CE2C8D834418FB61840B638E1D2371179B1DA9E41BBFDFE671EBADFA65A3D422561320C28058DE7D4BD46C7A6B53B341504972614B918544DEF5E5FC99C93
Malicious:	false
Preview:	........................................O..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl3y/l:Ls3C/l
MD5:	70580530C62554ECD774CFEA593C3982
SHA1:	D47B4AACB26ACB77F85B7A6BA1D328AD8092A35E
SHA-256:	654C8879EF724FBCCDEBFD6287FFD7453496000846531F8520B29AA926DD61D8
SHA-512:	81C91CA59BD6BBEADFE83D1D01109BF89706FDEDE850DC86C1A087ADBF6340B2CC0D84E2BDA7900CC303BF573E634E65965D3C4FAC2584794EF5F93152B4EC9B
Malicious:	false
Preview:	........................................fH.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	403
Entropy (8bit):	5.229865163182079
Encrypted:	false
SSDEEP:	6:PDVe3B1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLllDVHMJ+q2Pwkn23oH+Tcwt0jqE0:PxakfYebqqBvFLnxsEvYfYebqqBQFUv
MD5:	BE7B6BBF5E400905ADF2816A5D57629B
SHA1:	F336BE0C37F7DD159B17D4EE0939B8DFC9A16C2E
SHA-256:	9EA400A4CD7D22E79A583A769B801C0FDD2A8177EB5455B4D43248C31D1AD7EA
SHA-512:	4EE081D795CE39A9875291FE17806581D8AEC9278D103A6224A8543BBB403245407D1E5B9B62871A3F67B1D159984CFCC4CED918C36D80E0DCA5837DDE9FB6B6
Malicious:	false
Preview:	2024/09/03-23:02:57.194 1f28 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/09/03-23:02:57.220 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\21b7a89c-026a-4321-9279-ac599c3157c6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\62ab7463-a76d-48eb-871b-c58f99a54521.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\93062831-df90-4e95-857a-c8c63fb740ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3b98d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b030a5c7-c42f-40a7-9117-76df48f10db2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.1731023694361715
Encrypted:	false
SSDEEP:	6:PDqlB1wkn23oH+Tcwt0jqEKj0QM72KLllDqQN3+q2Pwkn23oH+Tcwt0jqEKj0QMH:PukfYebqqB6LnlOvYfYebqqBZFUv
MD5:	E8AADCFEE757795EC7FB959083B38DFD
SHA1:	7AC17C3A08DD112685FEDC6C0F3EDD9FACF7E55A
SHA-256:	B160AEDBAA88A2AE7A2DEA3832A282C33FB4A6506AC25C95A17B6ADFFC89E32C
SHA-512:	D9444995914E5EAAF8F0914F7ADE1363EBFFA80547A316AD3D90132C0645F64F2EEB6C59303B2E2B50E702583E07303CC9C2BA8B20ED57F3D1BC032B62975455
Malicious:	false
Preview:	2024/09/03-23:03:13.003 1f28 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/09/03-23:03:13.028 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.242884481561501
Encrypted:	false
SSDEEP:	6:PDPP0D1wkn23oH+Tcwtkx2KLllDPJMHN+q2Pwkn23oH+TcwtCIFUv:PYyfYebkVLn10IvYfYebLFUv
MD5:	3E2080CEA21E13322069F67D202861BC
SHA1:	50BA3639FEDC4A1C454C01475FD89531117421A6
SHA-256:	27B10AE637F0A7E7C17413025D8D1A707925D5C32A7AEFE3255AE7E7DFFC4FCD
SHA-512:	9EDFDA009CDBC7D09F5BBE74808E910840494006BF9B5FD8C26875024103F544D5018F3CE3C885BC563914096478F2FF32B9F56A83FFDD1A4ED4577200860FDA
Malicious:	false
Preview:	2024/09/03-23:02:55.138 1e78 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/09/03-23:02:55.158 1e78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVQjMl:IiVQQ
MD5:	9D42048C5D5E4257E4EEF70E7583811E
SHA1:	A1079E179228718ADDE62A6849462BA41E4D6F35
SHA-256:	5EB1CE9DBE0F17A6FEBCE454A95CF1D916FBBE7D8FB1B34CA98FD554EBC86483
SHA-512:	EF4CCBB0195C4C32B38632C1F4D977FB983BC393F178FF2A0B31851BEDC7AEDB42A0557A664D79393A8524B178BDD60D5454057558C93168479D9D328B3423FB
Malicious:	false
Preview:	VLnk.....?.......b....S................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0772278672556193
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOvSAE+WslKOMq+vVumY1Dn66:e/2qOB1nxCkOvSAELyKOMq+vVumWp
MD5:	3BAF95EBFAD7CED30DC2CAE186DD3A89
SHA1:	D03B0268B87E7C0C94C759780963594B62BE0A85
SHA-256:	7FDF5D2F9E600D4F43CB859C9E7B0E82A2D679525C08679D6F90580EDF7CB7A1
SHA-512:	883DB9C60C6C8F157E21A1C00C089037663E133839403A9936F33BE9D9BFF08AE6C53B4B56CD1A1CF7E5F7C5005FA3D7F9B11BD24919DB2870C95C3D8F17E93C
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\fef0d4e0-088e-44fc-ab89-3cbd4c868758.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.972077578144019
Encrypted:	false
SSDEEP:	96:stlqfXis13b9Yy9KN8zEfIs85eh6Cb7/x+6MhmuecmAelSX82Mu/EJ:stl5sZKNkEfIs88bV+FiAcPuMJ
MD5:	3E5DD75C9196D2D07DA732914810F102
SHA1:	4032E870C5F9E41785DA79222BA60877E69AF864
SHA-256:	FF879DB28AF5B303DFE7A98BAE0D829CFB79F85B26B6CD8A86A0FB4961084124
SHA-512:	1BA8CC762EAE182D410FB9636780E20EAD70F075C9BCE4AA192FAAF7C5A17E52F8E354173EE97511E7315CC90D5A7B6A5388395405C2B32FE3CF38E1B02C8485
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369892575706802","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369892576935425"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28109187076190567
Encrypted:	false
SSDEEP:	3:7FEG2l//ClPlFll:7+/l//m
MD5:	35257ECCD7674B1B82CE9884F7C0EAA2
SHA1:	AB89B6985F4639F693832B1626F5A24661137368
SHA-256:	19201BEF35C9C177A147A40D9EBD552F64AF65D2904B48D37E24A53BC2A1BBE8
SHA-512:	1FE67676315923BAFB7E72B33756B2642650279BDD2EB2ABFB30B7ACAF676E53C604F58265027EC21EFCCC639D012ADAC2666324DBCE9E2893C73674812CA1BD
Malicious:	false
Preview:	.... .c.....Z..<................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04986187416146411
Encrypted:	false
SSDEEP:	6:GLW0bgHW/LW0bgHtqL9X8hslotGLNl0ml/XoQDeX:aUHWDUHtyGEjVl/XoQ
MD5:	0238EA4B16911AC2405714E9B45CB1F2
SHA1:	AACA8BE838E519C4C8C78ADBD9D8D91A89875F38
SHA-256:	B6785D5F896EA6F390321DE98B9F902EC337B48D1FDCE6A84D741307A6606D59
SHA-512:	8676562D23B567D4468BCE897A539D42CC580619502A93C06F0A5958969B74646FF3A9A7138D0AF596B40FBC961933F8EEDFFCEC26F1A4C64D61701E5AB6C329
Malicious:	false
Preview:	..-.....................6...4J..61.r.5.X....Y....-.....................6...4J..61.r.5.X....Y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9972822813262203
Encrypted:	false
SSDEEP:	48:5zzxMlO+h8cbX+4n9VAKAFXX+Gk2VAKAFXX+fAGxOqVAKAFXX+sYnUYVAKAFXX+g:dxQ4NNsfNsYEO5NsiNsdi
MD5:	B093082D67125904E4EB9E45038A3429
SHA1:	DEDDBB9AE91BD6DF6088248CA2CC08053AEE1B5F
SHA-256:	7E791B943FE159143F7C2A25B8AED3289ACB7FAEBD3D2EDC00F566EE5E8B056E
SHA-512:	AA37E1304A71949AB56558AE00F14417FF8BE85D96D5D31F924FC9050D43D58345A22701D1B4B237DBDE11002C768848975E3965FC2CB1068C6061DDDA632B51
Malicious:	false
Preview:	7....-...........61.r.5...9.5...........61.r.5....!9v..SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.485098886205845
Encrypted:	false
SSDEEP:	48:68TSBSqQclUP+HRHoxuIYjIYczcqkNMYjMYBy7AlkfAlkd3:q0qQaIYjIYczcbNMYjMYoYcYw3
MD5:	188A4E5C79B86C5A65DA7FBF2FF97AD1
SHA1:	193EE6F0F3313A78DB92502B35169706FC78B007
SHA-256:	531534461F16150E62CD58BFA56A75AFEA7429B4A3779F0FF660F97ABEE60C64
SHA-512:	7AB05B9F3F54F04EA95F76EA625F554A0EF74A61F80D182768A3331656A039DD6F68C2B23A799CD329FA629880527133515992808322A6221F5988C4F970ECD1
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.....................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFeature......4_IPH_De

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.242395767604902
Encrypted:	false
SSDEEP:	6:PDPlQeR1wkn23oH+Tcwt0rl2KLllD4MbQ+q2Pwkn23oH+Tcwt0rK+IFUv:PpQe0fYebeLnEMbQ+vYfYeb13FUv
MD5:	561A53B5925F0283C5B81CCA055268E9
SHA1:	F896111C2FF6B8E4B838084C9E3755F00B2DEBB5
SHA-256:	8ACDAD34B0F1270BA3F3540308B66016CB1EBDD3919254D6607068D55046EA59
SHA-512:	51347A461FB75488EB7F3F4844E688D72308C1D0829E7C37209F21E198F411A98C1BE1BD09FEA68692DC34444E3C1DB28B419D4CBF283D8B3A32166AD03C7A08
Malicious:	false
Preview:	2024/09/03-23:02:55.915 1e4c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/09/03-23:02:56.432 1e4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.958141412815535
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Wui+it/4JbZfPStub/RG0lbANqa:G0nYUtypD3RXi6FZfc25m
MD5:	FBC524D02048C176A0A5D1B8B752932A
SHA1:	294C48557549A4C978326D9B7969E293A024F157
SHA-256:	F3FC95AE128DB918FC126F15CD9D96618482BA6ACCC622AAA19B10CE80B15EA0
SHA-512:	9B6434442E11610B8B5DDA43AA56656599925C9C8F0A364DDB69D15B37A912D223EE600012468E0DB723CAF3546FFBDF56F085A0159EA7968BBACE894AAFF856
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....!....................3_.....n.b..................4_.........................37_.......`.................38_.....].$&.................39_.....4.9..................20_......R...................20_.......1..................19_......(...................18_.....:.=..................3_......W2..................4_.....)..>.................37_..........................38_.....h.#..................39_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.211014145219029
Encrypted:	false
SSDEEP:	6:PDPDoR1wkn23oH+Tcwt0rzs52KLllDPlcRQ+q2Pwkn23oH+Tcwt0rzAdIFUv:PA0fYeb99LnpcRQ+vYfYebyFUv
MD5:	10AD2022552E752D71AE1ED3495504FB
SHA1:	99E4EF78F5B41E5450EF670F54F52805EDBC3532
SHA-256:	706FA4458711807F60F4F9685613CC87A6F61224BF15A04932E4BA1E19330341
SHA-512:	BF1030F2980E7E3A886D1BA829FB535EB771F557F0B34BC24D84D827165C60987889F87E974329365DFEAC11E54AB87F6581F0A4B0532939B878C44D92DB8FC9
Malicious:	false
Preview:	2024/09/03-23:02:55.899 1e4c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/09/03-23:02:55.911 1e4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlm+/l:Ls3mul
MD5:	29BC7C08CC9F33EF8D3CD0C29D4790B2
SHA1:	04ED36532F9D6FEBCD8BA7E6222429BCF9ACA442
SHA-256:	1B12713348E75B8B1D74F2C70C7DE7D36F360080C7AD90CC13F7E610741DF63D
SHA-512:	B140C7412146B27D4EFE900D1F7B44CF82C135B3AF6467C577A702B2159B578773A61F9397B7098B5E2DD5ACA9D1C6868D89ED5DBDB3C29CB8C70B09790F5D70
Malicious:	false
Preview:	.........................................e.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlA9Ll:Ls3A9Ll
MD5:	8FB89AC3451E6CEDB44487454A91B0F2
SHA1:	BDC99D9A91D17F142688B20E5910D7A2200FC273
SHA-256:	69DF2B206D1C29188A445F67F0C4B4DCEF931A2EF45B1FDF6528CCB780434314
SHA-512:	9BB2F586B409DC6D564DACE2FBCA4B425C7DDD7064689E422A26C12C145F78F43A2A4226A24AA834C366E3DCB968F99166BEF888D0BE95742172FD07D4AC71AC
Malicious:	false
Preview:	............................................./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.543196691043428
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt0vlR4pGdcoiiXsHUGy3B6yik4JdXBuBuwB+aS0NhMHpXdQQRZ:YuBqDPaf+vlRNdcolMUGy3aTgBzB+UM5
MD5:	D59027EF9A71DCD46386EC280CDB9697
SHA1:	8A86B1ED272B6542E4DF92C87BF2089D1D50F29F
SHA-256:	D5E1EE69018F44F2EE51C2A0C0ACD7394BEDBE094C277104CDA8C2C6D31CA8D5
SHA-512:	6B703DD8254000758342D8209E11478B03A3009194AAD9DC05A97F7C714FC37F237E343B4466922DA10A3D334C74D6AFCDA7FB369C9FFC3F49499804CD7F140C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"profile":{"info_cache":{},"profile_counts_reported":"13369892574518589","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725418974"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28989.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.543196691043428
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt0vlR4pGdcoiiXsHUGy3B6yik4JdXBuBuwB+aS0NhMHpXdQQRZ:YuBqDPaf+vlRNdcolMUGy3aTgBzB+UM5
MD5:	D59027EF9A71DCD46386EC280CDB9697
SHA1:	8A86B1ED272B6542E4DF92C87BF2089D1D50F29F
SHA-256:	D5E1EE69018F44F2EE51C2A0C0ACD7394BEDBE094C277104CDA8C2C6D31CA8D5
SHA-512:	6B703DD8254000758342D8209E11478B03A3009194AAD9DC05A97F7C714FC37F237E343B4466922DA10A3D334C74D6AFCDA7FB369C9FFC3F49499804CD7F140C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"profile":{"info_cache":{},"profile_counts_reported":"13369892574518589","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725418974"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28b6d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.543196691043428
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt0vlR4pGdcoiiXsHUGy3B6yik4JdXBuBuwB+aS0NhMHpXdQQRZ:YuBqDPaf+vlRNdcolMUGy3aTgBzB+UM5
MD5:	D59027EF9A71DCD46386EC280CDB9697
SHA1:	8A86B1ED272B6542E4DF92C87BF2089D1D50F29F
SHA-256:	D5E1EE69018F44F2EE51C2A0C0ACD7394BEDBE094C277104CDA8C2C6D31CA8D5
SHA-512:	6B703DD8254000758342D8209E11478B03A3009194AAD9DC05A97F7C714FC37F237E343B4466922DA10A3D334C74D6AFCDA7FB369C9FFC3F49499804CD7F140C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"profile":{"info_cache":{},"profile_counts_reported":"13369892574518589","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725418974"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28bcb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.543196691043428
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt0vlR4pGdcoiiXsHUGy3B6yik4JdXBuBuwB+aS0NhMHpXdQQRZ:YuBqDPaf+vlRNdcolMUGy3aTgBzB+UM5
MD5:	D59027EF9A71DCD46386EC280CDB9697
SHA1:	8A86B1ED272B6542E4DF92C87BF2089D1D50F29F
SHA-256:	D5E1EE69018F44F2EE51C2A0C0ACD7394BEDBE094C277104CDA8C2C6D31CA8D5
SHA-512:	6B703DD8254000758342D8209E11478B03A3009194AAD9DC05A97F7C714FC37F237E343B4466922DA10A3D334C74D6AFCDA7FB369C9FFC3F49499804CD7F140C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"profile":{"info_cache":{},"profile_counts_reported":"13369892574518589","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725418974"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2b2db.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.543196691043428
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt0vlR4pGdcoiiXsHUGy3B6yik4JdXBuBuwB+aS0NhMHpXdQQRZ:YuBqDPaf+vlRNdcolMUGy3aTgBzB+UM5
MD5:	D59027EF9A71DCD46386EC280CDB9697
SHA1:	8A86B1ED272B6542E4DF92C87BF2089D1D50F29F
SHA-256:	D5E1EE69018F44F2EE51C2A0C0ACD7394BEDBE094C277104CDA8C2C6D31CA8D5
SHA-512:	6B703DD8254000758342D8209E11478B03A3009194AAD9DC05A97F7C714FC37F237E343B4466922DA10A3D334C74D6AFCDA7FB369C9FFC3F49499804CD7F140C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"profile":{"info_cache":{},"profile_counts_reported":"13369892574518589","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725418974"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2e4b9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.543196691043428
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt0vlR4pGdcoiiXsHUGy3B6yik4JdXBuBuwB+aS0NhMHpXdQQRZ:YuBqDPaf+vlRNdcolMUGy3aTgBzB+UM5
MD5:	D59027EF9A71DCD46386EC280CDB9697
SHA1:	8A86B1ED272B6542E4DF92C87BF2089D1D50F29F
SHA-256:	D5E1EE69018F44F2EE51C2A0C0ACD7394BEDBE094C277104CDA8C2C6D31CA8D5
SHA-512:	6B703DD8254000758342D8209E11478B03A3009194AAD9DC05A97F7C714FC37F237E343B4466922DA10A3D334C74D6AFCDA7FB369C9FFC3F49499804CD7F140C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"profile":{"info_cache":{},"profile_counts_reported":"13369892574518589","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725418974"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3399f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.543196691043428
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt0vlR4pGdcoiiXsHUGy3B6yik4JdXBuBuwB+aS0NhMHpXdQQRZ:YuBqDPaf+vlRNdcolMUGy3aTgBzB+UM5
MD5:	D59027EF9A71DCD46386EC280CDB9697
SHA1:	8A86B1ED272B6542E4DF92C87BF2089D1D50F29F
SHA-256:	D5E1EE69018F44F2EE51C2A0C0ACD7394BEDBE094C277104CDA8C2C6D31CA8D5
SHA-512:	6B703DD8254000758342D8209E11478B03A3009194AAD9DC05A97F7C714FC37F237E343B4466922DA10A3D334C74D6AFCDA7FB369C9FFC3F49499804CD7F140C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"profile":{"info_cache":{},"profile_counts_reported":"13369892574518589","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725418974"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3758f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.543196691043428
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt0vlR4pGdcoiiXsHUGy3B6yik4JdXBuBuwB+aS0NhMHpXdQQRZ:YuBqDPaf+vlRNdcolMUGy3aTgBzB+UM5
MD5:	D59027EF9A71DCD46386EC280CDB9697
SHA1:	8A86B1ED272B6542E4DF92C87BF2089D1D50F29F
SHA-256:	D5E1EE69018F44F2EE51C2A0C0ACD7394BEDBE094C277104CDA8C2C6D31CA8D5
SHA-512:	6B703DD8254000758342D8209E11478B03A3009194AAD9DC05A97F7C714FC37F237E343B4466922DA10A3D334C74D6AFCDA7FB369C9FFC3F49499804CD7F140C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"profile":{"info_cache":{},"profile_counts_reported":"13369892574518589","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725418974"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF39c9f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.543196691043428
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt0vlR4pGdcoiiXsHUGy3B6yik4JdXBuBuwB+aS0NhMHpXdQQRZ:YuBqDPaf+vlRNdcolMUGy3aTgBzB+UM5
MD5:	D59027EF9A71DCD46386EC280CDB9697
SHA1:	8A86B1ED272B6542E4DF92C87BF2089D1D50F29F
SHA-256:	D5E1EE69018F44F2EE51C2A0C0ACD7394BEDBE094C277104CDA8C2C6D31CA8D5
SHA-512:	6B703DD8254000758342D8209E11478B03A3009194AAD9DC05A97F7C714FC37F237E343B4466922DA10A3D334C74D6AFCDA7FB369C9FFC3F49499804CD7F140C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"profile":{"info_cache":{},"profile_counts_reported":"13369892574518589","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725418974"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3fbc6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.543196691043428
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrt0vlR4pGdcoiiXsHUGy3B6yik4JdXBuBuwB+aS0NhMHpXdQQRZ:YuBqDPaf+vlRNdcolMUGy3aTgBzB+UM5
MD5:	D59027EF9A71DCD46386EC280CDB9697
SHA1:	8A86B1ED272B6542E4DF92C87BF2089D1D50F29F
SHA-256:	D5E1EE69018F44F2EE51C2A0C0ACD7394BEDBE094C277104CDA8C2C6D31CA8D5
SHA-512:	6B703DD8254000758342D8209E11478B03A3009194AAD9DC05A97F7C714FC37F237E343B4466922DA10A3D334C74D6AFCDA7FB369C9FFC3F49499804CD7F140C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABKbXXdLAxV1aqmEvebFJwiYH4ia0tnbV9CJMXqpIHXugAAAAAOgAAAAAIAACAAAAC9u7oXIW0k4yrlpBl9gwqiIP/6giyIIxH8/HB9hV9T2jAAAAAxUPCcAzu0C0vXXdS9IjPYZeiWkwcKZ1MuYo/iJSgH18sd9N8z/kQiTfyAa9//INRAAAAA3kx/3WYZXz3MS6sg5JP2J7lyZoM2IF5JiQEXq4O4qOAgO0v8raHdtqcM9cPQhDZPmLNLL5LT8t3/LBhDrHUb/w=="},"profile":{"info_cache":{},"profile_counts_reported":"13369892574518589","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725418974"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlnLl:Ls3nLl
MD5:	0E7EF39090F10E9CCD10855809DB9B8A
SHA1:	C9CC09D3E6507B0C7B9A2E05B4B8B8C44509A7C5
SHA-256:	E8D56FF466FACFC5768DDAFD51D677EB5C9E482CE2217864655D25F3714E8FB5
SHA-512:	F57FADB6AC835425150A0CB5FAAC319C0510AE2BF9652FE12B651535D4B6DA6ED9B9E2E519E845C5878F72E3E47AF7D2980ABDDC29CD3FE4029E6E3B05CF100F
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\b3540423-3d45-463e-bb4c-3e9a72cc6dd5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20986
Entropy (8bit):	6.063314144281514
Encrypted:	false
SSDEEP:	384:7tMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBS0feKh+Olif7Rp8mE2+q:xMGQ7FCYXGIgtDAWtJ4nY2w+Olo7p/z
MD5:	6E00494A2F0C723E5A93BCA32CB545EB
SHA1:	2A3C567954CE4CDF8E077302C070FCDBFD203456
SHA-256:	45334B0CDAC4EDC25C6F65443A3023763EB79A57C0A4FF51A80F8289AB58BFC8
SHA-512:	0020744B9EB58019D24ABD0E435039148E306C46768DA8725CCB311027BCA6284A751AC46FBDF670FD817C5C7DAF0CE302A819CCAA01B72A26E4FDDEFAC33353
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369892576977779","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\b654992e-18b2-4e72-92dd-8a5bb5112da5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71079
Entropy (8bit):	6.0730728887938055
Encrypted:	false
SSDEEP:	1536:xMGQ5XMBGLkMQ2XTKnVcQfTFLQ8XBRqtQ3414UkjwFPkq7Zz:xMrJM8LXWntjRqtQ34WUkjwNXtz
MD5:	04FEC353C99E3F5FA00E2CAE05CC4273
SHA1:	48ADB107F6C1E29E3AE45F8AFAA21B63BE44C068
SHA-256:	D2C1E31BDE8E813EFBEAD2D06853DA498710C9029CEC4AB72436B7B605C31EB8
SHA-512:	5ED8236ADFAC599BA423A6C45EB52281DA18A8834AC693BC0726562E73FFF76966C524E8D7C46629E650BA9F49AB3F7A9CEE0F5F29FE7A32C71BE3A13233EFC2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369892576977779","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\be04d2c7-75d0-455f-97ff-efa8c2c05b4c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	71040
Entropy (8bit):	6.073002831815901
Encrypted:	false
SSDEEP:	1536:xMGQ5XMBG0kMQ2XTKnVcQfTFLQ8XBRqtQ3414UkjwFPkq7Zz:xMrJM8EXWntjRqtQ34WUkjwNXtz
MD5:	EFEF0271EE0FFF2E36C3F2927D787509
SHA1:	BC23AF6E592BE2143991C6B035B1F55715F38342
SHA-256:	676F9A11F462F0D9A598D7509DEDF570A527CD4C1C3EE8FF48FA26B332F8B854
SHA-512:	89FB71A1143F0E6654B5110D45B10EE40BF5C141A328B3095E37E73BA5CF48D58F4AF66142F4FC71DE3B8AF5D82A46B504BFD0DFBE2D60CF2CE02A7C8E8C080E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369892576977779","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\efe6cc18-3130-45c5-9645-9e269cb0ff4e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24322
Entropy (8bit):	6.055203067691661
Encrypted:	false
SSDEEP:	384:7tMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NG0feKgIqdpVEOwPkxf7Rp8mE2+q:xMGQ7FCYXGIgtDAWtJ4nu2BOFPkt7p/z
MD5:	15BDDD9FCD1504637BC7651A3A86DE91
SHA1:	6D10417E656DC9A07C36257AAFAE413D2E8A5FB9
SHA-256:	35430B521676D5AA2EA8C151051B6C76493D328137780AB732C700D86DC522A2
SHA-512:	49880C94458B781A46F4B46AC830D7769FB6D1BAA3B7CC682DFD08AD7956E9E2F57586D05A554824461E4689A9E770FF5762A5B54C7E92C4753FBEF34F1B87BE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369892576977779","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1ed817ca-3d04-4243-b5a0-df74f7b5dfb3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.804538070665499
Encrypted:	false
SSDEEP:	192:fsNAWh3eiRUp8QMkOh6qRAq1k8SPxVLZ7VTiQ:fsNAySxHOh6q3QxVNZTiQ
MD5:	290E6F658089F910E9E30E1533A06873
SHA1:	854254190BF04A38704E4C0D0E9313AA062ECBB0
SHA-256:	14C1337ADF62AB65896757CD5652829607D05A9199D7DACA7B43E5E05A3BCB87
SHA-512:	095D9993A6DA281B95C1FE273900FBDF3D3A11E39609E703DC3EB6BFA3BBF358D485247124A85D8773BE4B1CC75A89EC3AB734C16DE6DBFFE7C29D7A527DC862
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5692669f-3955-46d9-b99c-000bbf127039.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.832342691754833
Encrypted:	false
SSDEEP:	192:fsNwWh3eiRUKF1gQ5zyDkOE96qRAq1k8SPxVLZ7VTiB:fsNwyvDH5OAOE96q3QxVNZTiB
MD5:	444AF91DE1E672594D56B60D6D780DCE
SHA1:	BA5FC76AB9CF05CFE38083FC3A50E12589E3220E
SHA-256:	DA89E29C5A339BF9B992B9AEBE10AC6047CF5CEC27B3D657D459D86D110C1A02
SHA-512:	18D7E7F2249A15BDF86C8180B3BA0B45444FF1AF031A24E0B4D6210665A276261E5A7FDB051D563BE57D729BDB36E7A9A8826D0C81AA980B412B01A92C5F37AB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\697d32c9-0ef6-4eb3-bfbd-a40de8d02ccd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.832342691754833
Encrypted:	false
SSDEEP:	192:fsNwWh3eiRUKF1gQ5zyDkOE96qRAq1k8SPxVLZ7VTiB:fsNwyvDH5OAOE96q3QxVNZTiB
MD5:	444AF91DE1E672594D56B60D6D780DCE
SHA1:	BA5FC76AB9CF05CFE38083FC3A50E12589E3220E
SHA-256:	DA89E29C5A339BF9B992B9AEBE10AC6047CF5CEC27B3D657D459D86D110C1A02
SHA-512:	18D7E7F2249A15BDF86C8180B3BA0B45444FF1AF031A24E0B4D6210665A276261E5A7FDB051D563BE57D729BDB36E7A9A8826D0C81AA980B412B01A92C5F37AB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\78863235-f1df-4ec4-b588-153d1a58a8d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.83227495680552
Encrypted:	false
SSDEEP:	192:fsNwWh3eiRUKF1gQ5i1FkOE96qRAq1k8SPxVLZ7VTiB:fsNwyvDH5GWOE96q3QxVNZTiB
MD5:	64928C86BDF76041790F48E1F9B03628
SHA1:	C191A23E587CA8DD82B1C92F52900FD9CB2C6B3E
SHA-256:	5B35433B13A3D27A1A8F36834F775E72591DEA7954C8B474FA8BE5EB5CC79FF6
SHA-512:	A8D661CE26FDBA14EA13303255BF87E90035140BF7870A93B0E5548059F11033B88857C26FC7CDF4715BF8C7E796B7A18536A6C0BE056D1D01230B6ACC0411FB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7f090832-6e90-4eb8-b680-5123f6f6ada5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.832355431371952
Encrypted:	false
SSDEEP:	192:fsNwWh3eiRUKF1gQ5EjvkOE96qRAq1k8SPxVLZ7VTiB:fsNwyvDH56MOE96q3QxVNZTiB
MD5:	3CC9ECF627F55B33D838BAE3F5E25FC5
SHA1:	C19D6EFE6A3A6DD62A90462D80CDDD71B47E50BE
SHA-256:	8645C7DC2513F11068E8F4770EA3809AE90E0D923777638D01D889A10A2B8A1F
SHA-512:	EB1A424B63F8C1FAE7CFED11EB85E8D70F7B66B5B9B072E080174A69FEDAEC990921843B7484814C643DDA8D9AAF988BBBCCFBCB3E699211E63E80AA679EA996
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8031bbb1-ba94-4153-9953-e8b3a62e2192.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46815
Entropy (8bit):	6.0810499868227845
Encrypted:	false
SSDEEP:	768:dMGQ7FCYXGIgtDAWtJ4nxUVn0SpLIcdlSrcVAEXZ7KKS7cNM474jzboU5:dMGQ5XMBGjSpVdlSrQAiZ7dDZ8jzV
MD5:	2C8684A8A26D76EFA5D8863C686DBF15
SHA1:	B7EE53FCF74E42E6D41A7C9DCF12FB7C32F8C84D
SHA-256:	D950B0A4F7A5BD1E75759177BCF01B66174898BB34B1FAD58159BBCB63B2C5EB
SHA-512:	38ACD668BA4F279D67A49682F511EF0A09DD5C09BAC4B6C19645900BBC9DC9D3C4FFB73BD49DDC947DB79C38A8F835E1E309815C8E9A80A4B5A15B3CF55590B1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369892588647662","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\82ab65ad-b6a5-478c-8071-e1ba43e7673e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.79828831113761
Encrypted:	false
SSDEEP:	192:fsNwWh3eiRUK8QMkOh6qRAq1k8SPxVLZ7VTiQ:fsNwyvxHOh6q3QxVNZTiQ
MD5:	08E07ADDE5DE54F3B7D6462AD11F0651
SHA1:	E20AD7B0DECA5A668748B2D1D81624A47258F485
SHA-256:	4A7E22625B5E9448B17FD2A20BA4D98EFCCBDD7A8BDBF37A872786510CA34B9E
SHA-512:	FDA0597FEB5E5C54A052871A094BBF052C91868240F66446AE07C67724115237F0FA084B5A67CF239B7AF07E8BE031E25E60578AF9D039193F76733EFA14BBCF
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8f991695-3789-4ff7-8703-d558c91ca671.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.832355431371952
Encrypted:	false
SSDEEP:	192:fsNwWh3eiRUKF1gQ5EjvkOE96qRAq1k8SPxVLZ7VTiB:fsNwyvDH56MOE96q3QxVNZTiB
MD5:	3CC9ECF627F55B33D838BAE3F5E25FC5
SHA1:	C19D6EFE6A3A6DD62A90462D80CDDD71B47E50BE
SHA-256:	8645C7DC2513F11068E8F4770EA3809AE90E0D923777638D01D889A10A2B8A1F
SHA-512:	EB1A424B63F8C1FAE7CFED11EB85E8D70F7B66B5B9B072E080174A69FEDAEC990921843B7484814C643DDA8D9AAF988BBBCCFBCB3E699211E63E80AA679EA996
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\38488e44-7c66-4d59-b606-37d6d50ecfdb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D7CDEC-23C0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3115649849866051
Encrypted:	false
SSDEEP:	3072:g0VwD/S4kcTFqtc7VirZNvM2rMQn3TkkhmFjdcjMaH/hYwVfMy9qnYsNfzlt6y8r:meNNwQn3TSX8y87aHPAqi
MD5:	60608FC00B99624903E718F4BC099DDC
SHA1:	8087F8A1BD3ADA02EBE95BE543138447827DAE12
SHA-256:	A7535ECD7F17C1BD411958A22BD7F8757FFAA52E901C5D2AC4DCE0DDD73E28CF
SHA-512:	D4DCA5C00698D82002EBC6DB5E531ABCD02D14CD0E94BFF5D6B377F15D819C655E021B7519C26464B9100D426FE099C639D586866DF1EA9CBBCB92D6E43B164E
Malicious:	false
Preview:	...@..@...@.....C.].....@...............HR...Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".poeqfm20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D7CDF4-26DC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03970747510369033
Encrypted:	false
SSDEEP:	192:fX0EbtmqvDtKX7eOJEa3XxxTVwg7XViV0DA5DhAVN/f+j1gQtHkrCq01n8y08Tcp:v0EtLOeQtEnhU4ZgUkGX108T2RGOD
MD5:	6097073C65E38EA16179A81B5B79A57A
SHA1:	7F19EF0CC8B871F0A02068076274D1A25F9A3B9C
SHA-256:	D9520EEB55AA1214A7A0EBB87988BABE8B4AF8F4ECC497388A852B81118DF43A
SHA-512:	5000791A0993485C07371775047F6C67163C56ACC5B98C59D722340A7ECB6C135D9F03051DDC3BE4D6546A5C77FADA3B0D275B2B8FF7C74F2C4B9D09A31F0F47
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".poeqfm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D7CDFC-2558.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03883310374392074
Encrypted:	false
SSDEEP:	192:zU0EbtmqvD3KX79aJEa3Xxx7UpXxgg6zfhj1NEx7GtM1gQMoLO70q2n8y08Tcm2D:w0EtZeZVQh52WsgULth08T2RGOD
MD5:	0AA365E66451D6922EADE05EDC6E28E1
SHA1:	60FAF5665C0198198624ACD317B8F97655C31995
SHA-256:	BFC6D9EFA96E441C23C9F0CC32256FCB4F32E8E7D7C855418D67A26AE45955A7
SHA-512:	2F2C75406AAF3F9802A37DD41E63E0EB9F74F8AE89FBB7FD4144738FE68E838D5F7204B14002A3ACCF255B9E51271F63130FF071DF636D8F43F8B0F369B5E664
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".poeqfm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D7CE09-1A0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038834973515135124
Encrypted:	false
SSDEEP:	192:zX0EbtmqvD3KX7ezJEa3Xxx7UpXxgg6zfhj1NErZGtM1gQMbJROuWsq2n8y08Tcp:D0EtdzeZVQh5WWsgXXBh08T2RGOD
MD5:	633A1BA3D7A777F4FFF9FAF8706006D2
SHA1:	2E426C5A18A585DE0DEED57377841425350E743E
SHA-256:	EC4D9F9CE1E1401CDBD9A7BDD20F791DD118C2E6F3CA63325383443AB6E3DBEF
SHA-512:	7EB6F59359F108D59BC461A2D37F12370A5B51F4AAD3AAD3901403F79837F2422F27CC89B03634FE978B7A678DCAB0B5070EBA626F4E8F81E9CAECFD3301C785
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".poeqfm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0760872c-7995-47c2-ba3e-0754fe17a27f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\47c9d25f-9c07-4148-8c6a-5e6016393660.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8561b764-4ade-4044-a537-d83f5d5c685d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.07301191972013
Encrypted:	false
SSDEEP:	96:sVLqlaJ16b9KmCzlYX4zUfrTAIzlbYAGsY5Th6Cp9/x+6M8muecmAeC5e4zvrs+/:sVL1JaUYooPnbYjsYPpj+FVAFs+FBf
MD5:	044BBB15B0394A9B1AE1FF4C0AEC6959
SHA1:	CE00E87F066EC2B69F7A7378B19954C8AB692385
SHA-256:	AF7B99CCEB7B1A2D266E61C8A2C3A9C9077A0C6945F8D4704106A69B8C73444D
SHA-512:	C6A382E7256AEA18A7D0903AA244059C4E1749CD68F13491015067EFCE71E0531ED245789C0AE4F47779E6351CA1D997C03DD8169212868BC5AEDEB37F59CACB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369892588632255","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8bcb0731-07cd-4aec-aa0d-ceb7a4bf0c3a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5581991341010815
Encrypted:	false
SSDEEP:	768:LPyvok7pLGLvfyWPDrfmx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNkS8/rwvh+Hcpw:LPyvoocvfyWPDrfmxu1jaYV8MJ+HMEt1
MD5:	E7F77217B60A674ABA3D4CADCB13F8FB
SHA1:	E50CFD8A1DF8D99F935F4ABD682EE821A1AA348E
SHA-256:	DF7FC508B52429F67089AF9C4D73779C9E5CB27F85086F421A6D597D7D0EA1F8
SHA-512:	78812E87FF06C008AA9136A4909CF8BFD711CAAA19F9D9B0EB7C37E63B2FB8132B21E8B08D4FCEF49D4358B6148254E39197E4950F96C428FA48E9FA6B0C3914
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369892588348236","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369892588348236","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321580542316936
Encrypted:	false
SSDEEP:	192:gAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:TOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	6C3F8F543B8D033430CD8AB88231A36B
SHA1:	6D3A55F1D0DBE6278FB4F0A5C5C0D546D51A29D0
SHA-256:	5A597A7B0BAE443175EAB319BC757450CBC922617146EC7970E56AF5238E6E6E
SHA-512:	1A724053358D768D1660C9EC14C974C69C60CD620B082140459312CAAC0D866D2077C3A8EDD2575AEA5EC226896ADC29AF446A875AFC9CE1374225BCFF2C4F08
Malicious:	false
Preview:	...m.................DB_VERSION.1.[...................QUERY_TIMESTAMP:arbitration_priority_list4...13369892590850897.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.0300020594807835
Encrypted:	false
SSDEEP:	6:PDGR1wkn23oH+Tcwt9Eh1ZB2KLllD3uAVq2Pwkn23oH+Tcwt9Eh1tIFUv:PxfYeb9Eh1ZFLnBvYfYeb9Eh16FUv
MD5:	DF084CA7BD17CEB683825DFC6DBCCFB3
SHA1:	A7891E7E31A8BB57FF4507994313F7F2CD521981
SHA-256:	67C6B7480FCDB5AAD388FBA1A907984323A67AA1EE8E4BBDBECECD8C3A340665
SHA-512:	3518EF232EA53368CFEF67C6CE9DA59104A16FDB075B0760572D6A24728C3791CF59E19C64F9BA32721C324CFDEE40E8E3A36672B49D0D5AD2D43C043852686F
Malicious:	false
Preview:	2024/09/03-23:03:10.040 22a0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/09/03-23:03:10.136 22a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl1oq:Ls31H
MD5:	7E95101A932D757DFEF836935EDC8484
SHA1:	B7CE845A6D2FC7E318B2D679D3A91B4728134D3F
SHA-256:	3C1E006A140EC527E2B09FCED817CD758E3B45FD51BA104EB644E4F2A5B65EF7
SHA-512:	F084AA62205DE74B1595A412C216515B73DD57933DD959E1AE7DF18DCEF1688674BBE20DE94B2D5FAAC8281FC1C7F23F0A1E1963FA13BAD122ED1233A599B3F1
Malicious:	false
Preview:	.........................................z.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.160079833700261
Encrypted:	false
SSDEEP:	6:PDiv1wkn23oH+TcwtnG2tbB2KLllDi+Oq2Pwkn23oH+TcwtnG2tMsIFUv:PTfYebn9VFLnLOvYfYebn9GFUv
MD5:	D557A329A16B1577B5FD0C74B149E10D
SHA1:	6CA8FD81E1638E291B661A767FB768E1682B9536
SHA-256:	09490D486C94E75AC01F96B7C43A81A6B77303CD5BD61B3DD17E3A2566B03B92
SHA-512:	86AFC283997A1AE2373704DA74FD62EEC195FEFFD57D136D5D792EAB6B7C8D2B6E998440B83095DE9671366664D9BE823429A5371036E980DEF11B15FCF16201
Malicious:	false
Preview:	2024/09/03-23:03:08.474 20c0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/09/03-23:03:08.484 20c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.144693637965205
Encrypted:	false
SSDEEP:	6:PDibg+RM1wkn23oH+Tcwt8aVdg2KLllDilIq2Pwkn23oH+Tcwt8aPrqIFUv:PCg+RrfYeb0LnnvYfYebL3FUv
MD5:	95647817F84EA3B4FEE4F5DBD4F51B86
SHA1:	D42615AFF5826EFCF70E5551D7A50E1F0024B2E8
SHA-256:	85617F6701F0DC2D0B10D46CE00AD41C8AE71D33E38BDC332317015A2DD9A046
SHA-512:	4DE5D13CC482DAD92ED2FB3D760E445CBC21D67B895CF90ADF858493EEFBB687D24D7A70820AB6D9A12D8651EE713DE8468E1FC668EE09BCBA220293294E08BE
Malicious:	false
Preview:	2024/09/03-23:03:08.477 2104 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/09/03-23:03:08.490 2104 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.123434765930166
Encrypted:	false
SSDEEP:	6:PDiVB+RM1wkn23oH+Tcwt86FB2KLllDiKGIq2Pwkn23oH+Tcwt865IFUv:P9RrfYeb/FFLnvvvYfYeb/WFUv
MD5:	19228F5C6939CA4A882BD113D141AF22
SHA1:	600DC1151781742C24F168FCFF5CC80B8EF41082
SHA-256:	23E5CDCCD34373D254FFA3BCE074F03979F0BC5ED706830EC756ACE7E573A823
SHA-512:	B1AAA104264CE657DC5EC9AAC3C9934FE379BCAA24146C19581596C544326813067839CCA37B97A02C7B3C1DE908546260E4D91468FAC8870BCDD72A25B3D06A
Malicious:	false
Preview:	2024/09/03-23:03:08.492 2104 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/09/03-23:03:08.502 2104 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.176577750331114
Encrypted:	false
SSDEEP:	6:PDimQq3+q2Pwkn23oH+Tcwt8NIFUt82DimJQZZmw+2DimJQNVkwOwkn23oH+TcwY:P3QqOvYfYebpFUt823G/+2365JfYebqJ
MD5:	C9079BD031C232AED41C9B30363CD196
SHA1:	0A84D4CEB95BAD11034930606E8205EDBAA5D754
SHA-256:	0A5A8F13E825175D9DB55F17FFF6595A77ACEF008638E521A1847CE4342F3C1C
SHA-512:	8F9397DDFE5CF558604742D8E4C115A7ED1ED07C0B159418B53DF15220E92380550BE04810B0754E5CD69917AE20C6DB1B682987AEF62B741BC139ABF3BA66DF
Malicious:	false
Preview:	2024/09/03-23:03:08.725 2148 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/03-23:03:08.726 2148 Recovering log #3.2024/09/03-23:03:08.726 2148 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.176577750331114
Encrypted:	false
SSDEEP:	6:PDimQq3+q2Pwkn23oH+Tcwt8NIFUt82DimJQZZmw+2DimJQNVkwOwkn23oH+TcwY:P3QqOvYfYebpFUt823G/+2365JfYebqJ
MD5:	C9079BD031C232AED41C9B30363CD196
SHA1:	0A84D4CEB95BAD11034930606E8205EDBAA5D754
SHA-256:	0A5A8F13E825175D9DB55F17FFF6595A77ACEF008638E521A1847CE4342F3C1C
SHA-512:	8F9397DDFE5CF558604742D8E4C115A7ED1ED07C0B159418B53DF15220E92380550BE04810B0754E5CD69917AE20C6DB1B682987AEF62B741BC139ABF3BA66DF
Malicious:	false
Preview:	2024/09/03-23:03:08.725 2148 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/03-23:03:08.726 2148 Recovering log #3.2024/09/03-23:03:08.726 2148 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3281731663735024
Encrypted:	false
SSDEEP:	6:VxHA/J3+t76Y4QZZofU99pO0BYh8bqR4EZY4QZvGq:VihHQws9LdshBQZGq
MD5:	E590A5F4E7FED46AB95A5474EFB490CF
SHA1:	9479736D35F2D4D10783D42BCCB916262C6EE1C8
SHA-256:	A6F321A968613D334B508EC19AE9652C40BAEF52232F8CC7128CD5792F924F5E
SHA-512:	0E5A3082D216742E90FB6F4A9B7421DFF64C9BE08977F284C20E17FDA195E846AF6F27F78DE6BAB780B418BBE0D26D62101DB8938121D9968AE9ABDDAEB81CCE
Malicious:	false
Preview:	............qGd....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.271772233819827
Encrypted:	false
SSDEEP:	12:P/I+vYfYeb8rcHEZrELFUt82/0K/+2/0mV5JfYeb8rcHEZrEZSJ:XBYfYeb8nZrExg8o080gJfYeb8nZrEZe
MD5:	62D6E7D409CF1EAC94259336120AA73C
SHA1:	EB2C0EEAD2C0390013BB2EAA17129D0D7E0C01E6
SHA-256:	DE28DC166EF348291F23B9041C911513D71BD049EA54D77C4CC537F8AF6616C4
SHA-512:	427D8A36354F98B3CA9E9A5BD04BCD7B860BE8B22E70BE353D4DD5D44E782196138AF1483AC08236324EDECA2D66CC471B7760A97183A96166264B68CFAA4C97
Malicious:	false
Preview:	2024/09/03-23:03:09.866 211c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/03-23:03:09.867 211c Recovering log #3.2024/09/03-23:03:09.867 211c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.271772233819827
Encrypted:	false
SSDEEP:	12:P/I+vYfYeb8rcHEZrELFUt82/0K/+2/0mV5JfYeb8rcHEZrEZSJ:XBYfYeb8nZrExg8o080gJfYeb8nZrEZe
MD5:	62D6E7D409CF1EAC94259336120AA73C
SHA1:	EB2C0EEAD2C0390013BB2EAA17129D0D7E0C01E6
SHA-256:	DE28DC166EF348291F23B9041C911513D71BD049EA54D77C4CC537F8AF6616C4
SHA-512:	427D8A36354F98B3CA9E9A5BD04BCD7B860BE8B22E70BE353D4DD5D44E782196138AF1483AC08236324EDECA2D66CC471B7760A97183A96166264B68CFAA4C97
Malicious:	false
Preview:	2024/09/03-23:03:09.866 211c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/03-23:03:09.867 211c Recovering log #3.2024/09/03-23:03:09.867 211c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.155868620136333
Encrypted:	false
SSDEEP:	6:PDi6R4DM+q2Pwkn23oH+Tcwt8a2jMGIFUt82Di6R4wgZmw+2Di6RnDMVkwOwkn2o:P/iM+vYfYeb8EFUt82/A/+2/pMV5JfYL
MD5:	4DB1B8401B55829D67BD04E8E6FFF494
SHA1:	88F64FA9FCB428FD3A1A162542D45420F5139B1B
SHA-256:	25008BE3EFB89622E127F8AF44048357D978AEF4FAAB7A40A721A1A5D23613F7
SHA-512:	AC726B0DF7D5D3843B44B2B8946BD3BB75F45B665927FDC489DAD37EDC753EA81E313E8E3EC187770BCE03E8706F12C9EFAB7F32BBCDD7E585C9BBF611C437A5
Malicious:	false
Preview:	2024/09/03-23:03:09.455 21fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/03-23:03:09.458 21fc Recovering log #3.2024/09/03-23:03:09.463 21fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.155868620136333
Encrypted:	false
SSDEEP:	6:PDi6R4DM+q2Pwkn23oH+Tcwt8a2jMGIFUt82Di6R4wgZmw+2Di6RnDMVkwOwkn2o:P/iM+vYfYeb8EFUt82/A/+2/pMV5JfYL
MD5:	4DB1B8401B55829D67BD04E8E6FFF494
SHA1:	88F64FA9FCB428FD3A1A162542D45420F5139B1B
SHA-256:	25008BE3EFB89622E127F8AF44048357D978AEF4FAAB7A40A721A1A5D23613F7
SHA-512:	AC726B0DF7D5D3843B44B2B8946BD3BB75F45B665927FDC489DAD37EDC753EA81E313E8E3EC187770BCE03E8706F12C9EFAB7F32BBCDD7E585C9BBF611C437A5
Malicious:	false
Preview:	2024/09/03-23:03:09.455 21fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/03-23:03:09.458 21fc Recovering log #3.2024/09/03-23:03:09.463 21fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2369e2e9-521c-4938-8fff-5c2f05ca9711.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5383821d-3a3f-4f80-b8a2-0c65992af075.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.308183908014515
Encrypted:	false
SSDEEP:	24:YXshZVMdBsqWhZFRudFGcsjZFGJ/dbG7nby:YXsn8stnfcdsNgzbZ
MD5:	12B32B0F9CA80EB9D8C6332C123CAB4B
SHA1:	6887F6A751D8552F9FAE984476BD2015E2A070D1
SHA-256:	D4D4F83A4B6A8F016F9A1444EBF9C8244DDD1C315809829BCBF097BBE70907C2
SHA-512:	DA1639A35620600BF232CC931BE32167ADE49074F394988455E4A44EFC6F27A4C14E13C22A3C013E6C779803674941D1F1AC8D23AC2E09D4F6A3E84A9820E1BE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372484590828100","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372484591821377","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372484594900679","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5cb3ec0d-3bcc-492c-870a-ab71b0ce9c2f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2ec2b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3d9d7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2c653.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2d4ab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2ec2b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b905b22d-4cb6-49de-b2a6-47a4d85546fd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\bc1a5d85-5cb0-4bf5-8b40-df5fe6a99dd5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d9f274a2-2291-49e6-97c2-d6c208c7ed2a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ddc00021-6979-4a6e-a469-ec8db8c95c2e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.07301191972013
Encrypted:	false
SSDEEP:	96:sVLqlaJ16b9KmCzlYX4zUfrTAIzlbYAGsY5Th6Cp9/x+6M8muecmAeC5e4zvrs+/:sVL1JaUYooPnbYjsYPpj+FVAFs+FBf
MD5:	044BBB15B0394A9B1AE1FF4C0AEC6959
SHA1:	CE00E87F066EC2B69F7A7378B19954C8AB692385
SHA-256:	AF7B99CCEB7B1A2D266E61C8A2C3A9C9077A0C6945F8D4704106A69B8C73444D
SHA-512:	C6A382E7256AEA18A7D0903AA244059C4E1749CD68F13491015067EFCE71E0531ED245789C0AE4F47779E6351CA1D997C03DD8169212868BC5AEDEB37F59CACB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369892588632255","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3420b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.07301191972013
Encrypted:	false
SSDEEP:	96:sVLqlaJ16b9KmCzlYX4zUfrTAIzlbYAGsY5Th6Cp9/x+6M8muecmAeC5e4zvrs+/:sVL1JaUYooPnbYjsYPpj+FVAFs+FBf
MD5:	044BBB15B0394A9B1AE1FF4C0AEC6959
SHA1:	CE00E87F066EC2B69F7A7378B19954C8AB692385
SHA-256:	AF7B99CCEB7B1A2D266E61C8A2C3A9C9077A0C6945F8D4704106A69B8C73444D
SHA-512:	C6A382E7256AEA18A7D0903AA244059C4E1749CD68F13491015067EFCE71E0531ED245789C0AE4F47779E6351CA1D997C03DD8169212868BC5AEDEB37F59CACB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369892588632255","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d013.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	5.07301191972013
Encrypted:	false
SSDEEP:	96:sVLqlaJ16b9KmCzlYX4zUfrTAIzlbYAGsY5Th6Cp9/x+6M8muecmAeC5e4zvrs+/:sVL1JaUYooPnbYjsYPpj+FVAFs+FBf
MD5:	044BBB15B0394A9B1AE1FF4C0AEC6959
SHA1:	CE00E87F066EC2B69F7A7378B19954C8AB692385
SHA-256:	AF7B99CCEB7B1A2D266E61C8A2C3A9C9077A0C6945F8D4704106A69B8C73444D
SHA-512:	C6A382E7256AEA18A7D0903AA244059C4E1749CD68F13491015067EFCE71E0531ED245789C0AE4F47779E6351CA1D997C03DD8169212868BC5AEDEB37F59CACB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369892588632255","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5581991341010815
Encrypted:	false
SSDEEP:	768:LPyvok7pLGLvfyWPDrfmx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNkS8/rwvh+Hcpw:LPyvoocvfyWPDrfmxu1jaYV8MJ+HMEt1
MD5:	E7F77217B60A674ABA3D4CADCB13F8FB
SHA1:	E50CFD8A1DF8D99F935F4ABD682EE821A1AA348E
SHA-256:	DF7FC508B52429F67089AF9C4D73779C9E5CB27F85086F421A6D597D7D0EA1F8
SHA-512:	78812E87FF06C008AA9136A4909CF8BFD711CAAA19F9D9B0EB7C37E63B2FB8132B21E8B08D4FCEF49D4358B6148254E39197E4950F96C428FA48E9FA6B0C3914
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369892588348236","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369892588348236","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3257b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5581991341010815
Encrypted:	false
SSDEEP:	768:LPyvok7pLGLvfyWPDrfmx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNkS8/rwvh+Hcpw:LPyvoocvfyWPDrfmxu1jaYV8MJ+HMEt1
MD5:	E7F77217B60A674ABA3D4CADCB13F8FB
SHA1:	E50CFD8A1DF8D99F935F4ABD682EE821A1AA348E
SHA-256:	DF7FC508B52429F67089AF9C4D73779C9E5CB27F85086F421A6D597D7D0EA1F8
SHA-512:	78812E87FF06C008AA9136A4909CF8BFD711CAAA19F9D9B0EB7C37E63B2FB8132B21E8B08D4FCEF49D4358B6148254E39197E4950F96C428FA48E9FA6B0C3914
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369892588348236","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369892588348236","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.128952184747509
Encrypted:	false
SSDEEP:	6:PDgdwDM+q2Pwkn23oH+TcwtrQMxIFUt82DgvgZmw+2DgkDMVkwOwkn23oH+Tcwtf:PEaM+vYfYebCFUt82EI/+2EoMV5JfYeL
MD5:	416BFBD5380E18ED9FA65AB2C0520101
SHA1:	77F6C5FE48A697B98243797FE472FBF2D1F77761
SHA-256:	58ED96D8CF4C59367786BAA79AE929F3FE656D684135FC078E93616515798CD2
SHA-512:	0E6A486A92765ED4AA4EF21793A72FD4D4047307512DBF62D59DF9470F0813D94EB47270FA5CF75FD8C3D5B50BC4772B969654ACD4FCBC3597114D25085C5ECB
Malicious:	false
Preview:	2024/09/03-23:03:24.794 21fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/03-23:03:24.799 21fc Recovering log #3.2024/09/03-23:03:24.806 21fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.128952184747509
Encrypted:	false
SSDEEP:	6:PDgdwDM+q2Pwkn23oH+TcwtrQMxIFUt82DgvgZmw+2DgkDMVkwOwkn23oH+Tcwtf:PEaM+vYfYebCFUt82EI/+2EoMV5JfYeL
MD5:	416BFBD5380E18ED9FA65AB2C0520101
SHA1:	77F6C5FE48A697B98243797FE472FBF2D1F77761
SHA-256:	58ED96D8CF4C59367786BAA79AE929F3FE656D684135FC078E93616515798CD2
SHA-512:	0E6A486A92765ED4AA4EF21793A72FD4D4047307512DBF62D59DF9470F0813D94EB47270FA5CF75FD8C3D5B50BC4772B969654ACD4FCBC3597114D25085C5ECB
Malicious:	false
Preview:	2024/09/03-23:03:24.794 21fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/03-23:03:24.799 21fc Recovering log #3.2024/09/03-23:03:24.806 21fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.119646299932344
Encrypted:	false
SSDEEP:	6:PDiaIq2Pwkn23oH+Tcwt7Uh2ghZIFUt82DiRZmw+2DiLkwOwkn23oH+Tcwt7Uh2w:P+vYfYebIhHh2FUt82E/+2k5JfYebIh9
MD5:	50DDA9F9615DD04A53F8DD0FFF4912CA
SHA1:	B294074A462B46283B769CC85B9F80DE1C89A458
SHA-256:	3B11015A3797DE5A765D6253FDA3C075A615DA0AABB288FA134C19BD3199484F
SHA-512:	77D2BC77C7D56524DDACF440D83528D0FC06C51EC4A7576147F857693BA4B272BE635B11B52E88958E627292AFB86FFD7C352842EE5FAD7F899A3BE69036EE96
Malicious:	false
Preview:	2024/09/03-23:03:08.462 2104 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/03-23:03:08.474 2104 Recovering log #3.2024/09/03-23:03:08.474 2104 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.119646299932344
Encrypted:	false
SSDEEP:	6:PDiaIq2Pwkn23oH+Tcwt7Uh2ghZIFUt82DiRZmw+2DiLkwOwkn23oH+Tcwt7Uh2w:P+vYfYebIhHh2FUt82E/+2k5JfYebIh9
MD5:	50DDA9F9615DD04A53F8DD0FFF4912CA
SHA1:	B294074A462B46283B769CC85B9F80DE1C89A458
SHA-256:	3B11015A3797DE5A765D6253FDA3C075A615DA0AABB288FA134C19BD3199484F
SHA-512:	77D2BC77C7D56524DDACF440D83528D0FC06C51EC4A7576147F857693BA4B272BE635B11B52E88958E627292AFB86FFD7C352842EE5FAD7F899A3BE69036EE96
Malicious:	false
Preview:	2024/09/03-23:03:08.462 2104 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/03-23:03:08.474 2104 Recovering log #3.2024/09/03-23:03:08.474 2104 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul6:LsN
MD5:	F3F793C491C85CD5D1D4864337B03ACF
SHA1:	44E1EAB3DA52F9F8A8B264FEDDF47A4AE25AFC83
SHA-256:	3AA0683406D621FE2BD62A75A6A8477D49CA3F6308B3FA8FCBE38B00207D7B5A
SHA-512:	5DE84030355E216EFC6B23E7681756816AE0C6530BBF34537783D85E18DC0C74F6942D02721A2FA0C7CACCBEE29416C0A0C6781EF98C98DBD355B3F12AAEAFD6
Malicious:	false
Preview:	........................................"[.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlYlv/:Ls3Yx/
MD5:	5A238D26216644A841504C3DCDD999B8
SHA1:	6C375E5EFDC75DB5B9EBB8DBBBC7E4F09AF09981
SHA-256:	60BD09A122031E2400E5C7183B09B6DE91EB032DAF9EDBFC7E10AA654390C1DD
SHA-512:	8EBED68ED8D8A9E9D20B625602AD886EE8F7BEF9DCD769B633F39268BCF49E20E879ECF03CBA1D1D133DC8780DDA5FEA5880481A24669B31C1D818C4468B4508
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.214639934492499
Encrypted:	false
SSDEEP:	12:P/LqM+vYfYebvqBQFUt82/4/+2/+MV5JfYebvqBvJ:X4YfYebvZg8o+LJfYebvk
MD5:	9D17E8530FE6057F215262F59C2CA8CF
SHA1:	319CA35A504DBAAB9319ACC17A0B477C245DECD2
SHA-256:	64BDA0B6BFBCCCE1229622285BDF41295310E0EB8448DF02B22C6364BDF67888
SHA-512:	1792103D3436B56AEC3DEFC9EB0FC3CC867DB885438562E38AC3D670ED09DC5D4A99A7554D5A9390D966C5625E50BAAFA1D38AF446E37F38AB97A8DE8CD7E5C1
Malicious:	false
Preview:	2024/09/03-23:03:09.482 21fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/03-23:03:09.483 21fc Recovering log #3.2024/09/03-23:03:09.495 21fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.214639934492499
Encrypted:	false
SSDEEP:	12:P/LqM+vYfYebvqBQFUt82/4/+2/+MV5JfYebvqBvJ:X4YfYebvZg8o+LJfYebvk
MD5:	9D17E8530FE6057F215262F59C2CA8CF
SHA1:	319CA35A504DBAAB9319ACC17A0B477C245DECD2
SHA-256:	64BDA0B6BFBCCCE1229622285BDF41295310E0EB8448DF02B22C6364BDF67888
SHA-512:	1792103D3436B56AEC3DEFC9EB0FC3CC867DB885438562E38AC3D670ED09DC5D4A99A7554D5A9390D966C5625E50BAAFA1D38AF446E37F38AB97A8DE8CD7E5C1
Malicious:	false
Preview:	2024/09/03-23:03:09.482 21fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/03-23:03:09.483 21fc Recovering log #3.2024/09/03-23:03:09.495 21fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0e589f7c-8416-4f70-b80b-389ce0a50ccc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\70fca729-d084-4b37-8a09-a1e8928b35a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\73703286-e6de-4209-bbe5-9309abbbe76d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7fd6dda0-45c4-4362-b5c2-1724a7bf0a80.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3e9c5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2d4ab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.2387985500826995
Encrypted:	false
SSDEEP:	12:PEmFMM+vYfYebvqBZFUt82Ey/+2E8MV5JfYebvqBaJ:cy6YfYebvyg8bv1JfYebvL
MD5:	E74F837B53A49369E15B2B74615159D2
SHA1:	6EB9B13BFE73CB52B9FD50ACD5CCEC423B0D02DA
SHA-256:	42AFA2AE8E94FC8E935C6C1ED46572ADF3A348A2ADCEE59AFD45C4EC896CCA0C
SHA-512:	B9D197F3CFFB2EB8B9E9FACC60073673E62C4269AABE2027476DF654B40762EFC8D3ACFAD447F611DCA9C0889B8A042D70B6E68463D6A9BD8974A324DD49D39C
Malicious:	false
Preview:	2024/09/03-23:03:24.687 21fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/03-23:03:24.689 21fc Recovering log #3.2024/09/03-23:03:24.693 21fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.2387985500826995
Encrypted:	false
SSDEEP:	12:PEmFMM+vYfYebvqBZFUt82Ey/+2E8MV5JfYebvqBaJ:cy6YfYebvyg8bv1JfYebvL
MD5:	E74F837B53A49369E15B2B74615159D2
SHA1:	6EB9B13BFE73CB52B9FD50ACD5CCEC423B0D02DA
SHA-256:	42AFA2AE8E94FC8E935C6C1ED46572ADF3A348A2ADCEE59AFD45C4EC896CCA0C
SHA-512:	B9D197F3CFFB2EB8B9E9FACC60073673E62C4269AABE2027476DF654B40762EFC8D3ACFAD447F611DCA9C0889B8A042D70B6E68463D6A9BD8974A324DD49D39C
Malicious:	false
Preview:	2024/09/03-23:03:24.687 21fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/03-23:03:24.689 21fc Recovering log #3.2024/09/03-23:03:24.693 21fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.153056047773339
Encrypted:	false
SSDEEP:	6:PDiOv8vIq2Pwkn23oH+TcwtpIFUt82Di0Zmw+2Di0kwOwkn23oH+Tcwta/WLJ:PrdvYfYebmFUt82h/+275JfYebaUJ
MD5:	DDB7FC9626DCFF38CE42C0DB8C34288D
SHA1:	2EEE366F98D2C4F06ECC594160382714287721DF
SHA-256:	CEDC406D88B7AAC3275F20D0AB20162385FC744E4F624D654B8B2499286494F4
SHA-512:	F5D5D69CFB6786724DC5DAC98CC7509DD57F8A460701C502FBF5BACA932C3884469F8C88BF5DDD250AD5FEC821A9C6540602D80B7AB7F615E829901158E265C6
Malicious:	false
Preview:	2024/09/03-23:03:08.540 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/03-23:03:08.626 2100 Recovering log #3.2024/09/03-23:03:08.626 2100 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.153056047773339
Encrypted:	false
SSDEEP:	6:PDiOv8vIq2Pwkn23oH+TcwtpIFUt82Di0Zmw+2Di0kwOwkn23oH+Tcwta/WLJ:PrdvYfYebmFUt82h/+275JfYebaUJ
MD5:	DDB7FC9626DCFF38CE42C0DB8C34288D
SHA1:	2EEE366F98D2C4F06ECC594160382714287721DF
SHA-256:	CEDC406D88B7AAC3275F20D0AB20162385FC744E4F624D654B8B2499286494F4
SHA-512:	F5D5D69CFB6786724DC5DAC98CC7509DD57F8A460701C502FBF5BACA932C3884469F8C88BF5DDD250AD5FEC821A9C6540602D80B7AB7F615E829901158E265C6
Malicious:	false
Preview:	2024/09/03-23:03:08.540 2100 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/03-23:03:08.626 2100 Recovering log #3.2024/09/03-23:03:08.626 2100 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:wDK/l1lhtlOR:wDc3eR
MD5:	939F22D70ED77FD12080E40160497A62
SHA1:	F019900FFA2F016F74D02133AC4D1C3B042211C1
SHA-256:	418E68A8D4B12C2BE46DE8CAC8A489EED95952FE871ECBB29817FE0E6D47522D
SHA-512:	0ACE2BAC9FBF40624E8CF6E906FF73E9B94243468EC77162913BCB644420179C33784BCA301DC18478339385F4204428AE2D0E05EA4E2849ED8F9CBDE33E346C
Malicious:	false
Preview:	...................W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c11ebe00-2347-4f4b-9a93-3843ca3e78d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9335
Entropy (8bit):	5.184269550782491
Encrypted:	false
SSDEEP:	192:sVL1JaUYooPnZ4E5KYjsYPpj+FVAPs+FBf:sVL1JaUcZ40HpUVOsW
MD5:	D16BACC364699B3F2829F8669A4ACA9D
SHA1:	52038B2BA5555E753829974FFAF249A0F9E99753
SHA-256:	EE26AC08AD49AD5DF0E274BA60BF5ABC48C6019D978301B3694C5A77865DDC6B
SHA-512:	13FDEBB58DD8FB5D9407CB57618D06E2B087B3B36AEF536D7B0B6458A4708636BB50E9ACA89781FDC6E6C17E219A011B73FF799A0130AD324B9CE65593BB1CAD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369892588632255","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dc65e656-84d4-4234-9595-d715823380a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9297
Entropy (8bit):	5.1855867126186
Encrypted:	false
SSDEEP:	192:sVL1JaUYooPnZ4E5KYjsYPpj+FVAEs+FBf:sVL1JaUcZ40HpUV9sW
MD5:	12E67AF92E5AE9B5BA8624AAE3AE95C1
SHA1:	224547456C4D3CF27651A0B527537072AD64C4A9
SHA-256:	2B366CBEB34B68BB1862711AAB9D20061F6822653E161842351E3DF9FC2E26A1
SHA-512:	32F70BF47665BCE0847439B21026EB76FF052716BC14C23154305D54E462CF6F26167B10AFFEFF8712620A031B03974366E5C36146AA0C0A0E965387F4FAC514
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369892588632255","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e390a8b4-21f6-4a66-9133-7b6dbc3185b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.566100150300931
Encrypted:	false
SSDEEP:	768:LPyvok7pLGLvfyWPDrfNx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYVmkS8/rwvh++I:LPyvoocvfyWPDrfNxu1jadVmV8MJ++ML
MD5:	8F5E2378A728A4C2AAEBB12B57A3A9BD
SHA1:	88A3D5E3CBB19AC223872EA7E132153F5A529D43
SHA-256:	2032948A4CB54EF41F9378EF8D15140CB552E88B3DF89A12A9E6CFC7E0BB0B32
SHA-512:	A2F124E8F6E4167F8A5ED6A0E4417FC495266DC1922E368A51618661BF3FF0511939DB2CAFF3F219E0406E7F9D873C6BC072F0C9415539385782D340E8AA5A95
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369892588348236","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369892588348236","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.307361565765852
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQvxlfWVZ/ll3seGKT9rcQ6xsECEOtl:/XntM+4lCll3sedhOsENO
MD5:	6DC463F72109AC17966F7384E383B0B7
SHA1:	199C93A0353E9CAD6599B2831E53A18EA523FD92
SHA-256:	1F1C7A7EB75950D162D25981291C8966FFF0A665920621DEB3181D438E6899B4
SHA-512:	92E8A19CD7613F2A5AF8ABCEA2EAD432B34DECA465D34E84E887CED08EBBA80A05845EDD40F0FDBEC5AD7B39924A016A6E63A71C0F2ED676937633C953932F35
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f...............i.\|.0................39_config..........6.....n ..1u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.231097919139462
Encrypted:	false
SSDEEP:	6:PDi701wkn23oH+Tcwtfrl2KLllDi8FN+q2Pwkn23oH+TcwtfrK+IFUv:P6fYeb1LntFIvYfYeb23FUv
MD5:	07FE20B02B900451E6A1E63A3B8929CC
SHA1:	193126F0891A709E31DD1B7944BA1646FE11C7B5
SHA-256:	8106A11FFF9C3FE73E5D48507D26133AF008238C4B5CB5B572C0C7C27200272C
SHA-512:	0E31AB99B2B6082AA5D059C1C3BDE9EBF7F3543F5BE5B933E18E34EC9CF04AC7FE586F3AEDC328BD66844A424685192041B2418C6BD7AFAFB5A361BA7D435E6C
Malicious:	false
Preview:	2024/09/03-23:03:08.671 2108 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/09/03-23:03:08.697 2108 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.920239416161529
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/5/Xt21tzJ3PEWXZvU7h/2Rdj0QWQ0:G0nYUtPrPJ6B/XMtzNP96hORdZx0
MD5:	9C4BE68AEE77C52D027B06D64C911EB9
SHA1:	00C64B0C24830A7E5B8E543351AEB6A6C7B9E309
SHA-256:	46174541EE66844449F6058AEA76924214D5843EBF66D6CEA7516406DF110C27
SHA-512:	B57EC2CEB111F8A310F30C4CC5EC696433E1D2E32C323DC56D3E3CDE78B338BA66E5AAA57D5C562C444B5FE7C939B4F2A99BD57141212C0FE9DABC59CE460EA6
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_........e.................18_......E...................37_.....`0M..................38_......Hf..................39_.......w<.................20_.........................20_......Y...................18_.....{a...................19_......m=.................37_.....uTN..................38_.......h.................39_........I.................21_......j...................21_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.203310545287834
Encrypted:	false
SSDEEP:	6:PDioU1D1wkn23oH+Tcwtfrzs52KLllDiuo+q2Pwkn23oH+TcwtfrzAdIFUv:PD0yfYebs9Ln1vYfYeb9FUv
MD5:	2B4DD36647A0CF96BDDC2197479A3500
SHA1:	D5CB081AE7A9DCD5E6F06F831ED2E3A6C936D67A
SHA-256:	57ADFDFF59474F0F2F67CF22AEAEA8391778057800E7E97C0F728B345DDC909E
SHA-512:	3DE5AFC3D91C0E9E7CD383901B7D2853BD11EEB69F17A2C84D65464168FE4098C1535B7A64575D3A33B827816D4C47E29F4B0A94BCAAF5390311CFA9823A3B19
Malicious:	false
Preview:	2024/09/03-23:03:08.557 2108 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/09/03-23:03:08.669 2108 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlPtTl/:Ls31Tl/
MD5:	E140426279156D5D30114AC8590D4F50
SHA1:	996AC08F683A09E89EC7110C7CFF6249E6C271FC
SHA-256:	1FE1C2D404E34DB1E18087A151E9573E6E0D19DBAD42EDABBCDDFC348823CAAD
SHA-512:	263092CB2150512D515DAA4FAADCA6648F3979CFA074C37AE3785B5EA00576136B906BDD3367ACBB1FC0EFC1B397EF9F2519CDF87DC60877A615B7A7FFE669D1
Malicious:	false
Preview:	........................................Q#..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl7XX:Ls37X
MD5:	D4B53D627809C3D0E8221958E0CAEA4D
SHA1:	8F9E17DD301DDDA96E4AD939A11D72319082B4B2
SHA-256:	74E6BCEBD16618C086DC52AAD5536C9CE6D43583E00998C7058E8993EDE03EAF
SHA-512:	8BCDE09A7377378AF9A9E9353B37A8A9CDA0A570EFE141B9988FBCE6C1073C7E47A5AA089A47B92EFE38BC71EDFDBA57DD6ED5195A4CA7EB5143A81E595AFD7D
Malicious:	false
Preview:	........................................D...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2bf20.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2bf4e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2dfc7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2dfd7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2dff6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e005.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ff26.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ff45.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33394.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF333a4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a8d4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d003.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41f9a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlrDaKX:Ls3Kq
MD5:	D4014E84D04323EEFDDCBA91CD1B4E7B
SHA1:	A54665A5188DB7EDC0648D91D22BCC006C4F94A5
SHA-256:	841A214404B4007D8FDCBDC61F67AA69EB3A99D0A459D636D64BD8915D1EF0A0
SHA-512:	1EE3404EFBC7664C193EA986C559F2E55BC5095074FD47D4D38B26ED878A6328407EDC40484A8D74FB2837D3D2115B05C89725D355E393CA609A50AF920DD050
Malicious:	false
Preview:	........................................<.l.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a057abf8-5a58-45c5-94e4-d594d176e019.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.798289480165801
Encrypted:	false
SSDEEP:	192:fsNwWh3eiRUKRQXkOh6qRAq1k8SPxVLZ7VTiB:fsNwyvuUOh6q3QxVNZTiB
MD5:	66B331DEAAC0DB4545F3B34C2D714D05
SHA1:	F941E378CE546729D12E0B820673F3B64F9AFE74
SHA-256:	1FDF74A55F14A5F89911EA604ECBB04525B905A837D7155917B6FABCA7461E89
SHA-512:	327E9B53794634B85668C7E2A6C3F8A5F3F78452249ECEAC06B4B21B9A6E2145635F70A6602FC496A8B6735F1E085701FD4B7A73583C99775296B5D98D439300
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ae80d316-7ddc-411c-8fe9-5d3c24cfc3c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.7919378662218355
Encrypted:	false
SSDEEP:	96:iaqkHfe28/5ih/cI9URLl8RotoAMFVvlwhJe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akWhoeiRUvhr6qRAq1k8SPxVLZ7VTiq
MD5:	7E907D7AC83689D5FB759AE4AC4BDD1C
SHA1:	BE4F86B29F6D1092E2EDE20DFC145793B9D7F0A0
SHA-256:	04F14F84F129F399E5CB0449768898A24E888C8033526629AB56621E5C881CE9
SHA-512:	D48745AACD91B79B30CA55E7950193581451561F3707223566075A392B9F85C817D077B58B4E9F1E617A365F0DE3017908361AB1D64B29A9B605153E8A7B71D2
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACAiF189jJFT6qON2nlu6a+EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACGNsp9oIPl70Kf8X9E4k7wYDnCv/nN6n+RDKdeByCiTAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c1c97686-f7f7-44ca-98cf-23d23a85f338.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24685
Entropy (8bit):	6.053837129247008
Encrypted:	false
SSDEEP:	384:3tMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNOzXXbazdjzbdEN555LI0v:dMGQ7FCYXGIgtDAWtJ4nxX4jzbdU5
MD5:	AA9D0AA32F1526B7A5A75C3D354E4BF2
SHA1:	D8E6FDB7822B3AFEB9C102F669289E279C066D36
SHA-256:	F534F1F7B946E8314046A7B47B5C1528A70A40C43CE7F64252C3B98458FD195B
SHA-512:	959C878CA7A36C4BF436D7D770211894FC9D4F10AD40CB1CD7904B0637C0505BF607BA738D434A23BEE89A93387E142897C76B4963FAC82CF482CB17B85092F3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369892588647662","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c8f3c2d3-e171-41b8-87f1-d01163cbd18b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46854
Entropy (8bit):	6.080938771577239
Encrypted:	false
SSDEEP:	768:dMGQ7FCYXGIgtDAWtJ4nIUVn0SpLIcdlSrcVAEXZ7KKS7cNM474jzboU5:dMGQ5XMBGISpVdlSrQAiZ7dDZ8jzV
MD5:	CA9B71797919372EC344E937751278A1
SHA1:	92206A5A28C7059FA78CE154B243DAEDE164DB3F
SHA-256:	DAEA902A3CAFEB291734C4DF179F548505A74542AB219BE8089E60DFC8C2081C
SHA-512:	56D38C1C2A13733717BFEBBC1FC6AC6B4040C1B6A6A5C79DA377BBC63B9B1ADA5CF32BDB74BAC5B3556B62F6FC1B589D707561446DB3CC82BE61C49A33B43DAE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369892588647662","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d0651116-a350-46d1-9652-241ede2bd7cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.059153342528197
Encrypted:	false
SSDEEP:	384:3tMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwzX1HOoEN555LI0v:dMGQ7FCYXGIgtDAWtJ4nH1HOoU5
MD5:	AC1427B6634409EAE6E4DF2AC41B807B
SHA1:	52E3B96E14E61B0D6FDB31ED0EC630B7F85A0578
SHA-256:	C28D6F9697DACADFF3E954849E2CC2E58CC123C0722FF2186C174C936A5B1875
SHA-512:	915DD6B7D63E5B095C80B39BEAAA6B7361ADACFB995A857A4B0BBE0E6BCFB7C46693A5ED934C4C1B11E793932F6EA7E8D5568D7477AA6476B1524FA27FB9C24D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369892588647662","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\edbbd98c-58fd-4ecf-a329-fb2d2a0b002d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.83227495680552
Encrypted:	false
SSDEEP:	192:fsNwWh3eiRUKF1gQ5i1FkOE96qRAq1k8SPxVLZ7VTiB:fsNwyvDH5GWOE96q3QxVNZTiB
MD5:	64928C86BDF76041790F48E1F9B03628
SHA1:	C191A23E587CA8DD82B1C92F52900FD9CB2C6B3E
SHA-256:	5B35433B13A3D27A1A8F36834F775E72591DEA7954C8B474FA8BE5EB5CC79FF6
SHA-512:	A8D661CE26FDBA14EA13303255BF87E90035140BF7870A93B0E5548059F11033B88857C26FC7CDF4715BF8C7E796B7A18536A6C0BE056D1D01230B6ACC0411FB
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8561188922812786
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxLpxl9Il8uAsbez07ngM0GRskTeNljOehWkJd1rc:m4YGx07nglGrej38kq
MD5:	1B762AB2F365908BF16BD72C4307DE53
SHA1:	ECB1B3CA4E54A37B632AA118151F2FFE75377453
SHA-256:	DB3C108E8231AC205A3801EF78DCBC6A9A8B20430E66F1C9060C8548B4940999
SHA-512:	C49A6860FA5614F18D25BBA09EC17E8725D20B4762A2A89E041627DA4343CC14D8738FB8C9264FA8927700045510E203740E79F3383D9EC333D1440AC82E9DCE
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.E.W.8.U.3./.+.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.g.I.h.d.f.P.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.002428517576931
Encrypted:	false
SSDEEP:	96:qQYGKiZ0xXctgcPVa+fZTYqe7fByYdpMOB:xzKi6xstgEC7lrMOB
MD5:	ED519EF2921A5918155A9B363C4C6B0E
SHA1:	9AFC0EF884463E44488928D3425C1CFDA36A9232
SHA-256:	92C40F9486CE520E9C2AC279661A5DE851740746C88FE0B938BF0A8EAE430F0A
SHA-512:	D1C6A0F53759A07432850B2C8105657506766F7BE0A2FDBCCD0B667CB61A50F2005C0914FD88A398E822B0D36CB127161322B4D3264D9098D662FEA1CAFAC843
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".3.v.C.w.O.X.f.+.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.g.I.h.d.f.P.

C:\Users\user\AppData\Local\Temp\65344d01-2637-4729-a056-7d99b8167da7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\7106735f-a8c8-4756-8b85-15582b3ed228.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9a6da8b4-8ec5-4ebb-b899-3c2dbd1aebbd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.304213042954703
Encrypted:	false
SSDEEP:	12:YmjZ0Dkv/iMkG56s/iMArB0Dkv/iMGe56s/C:YmjZ03MkG50MArB03Mv5M
MD5:	6A8985CDFFDB22F6058A26ADA92231EF
SHA1:	D97C8432D7B8BFFA75205CB8D997D1F29D0270FA
SHA-256:	CEE55E45DA77A696FF8A978244058B656A0B4D610C727E4A0C2894488D194CCC
SHA-512:	C963E843252F8673A1077A97DD259DD9F7154B33E48A339126A6DC0E89D8224838111D8953B861DD794C399575F9C91C65DC3743C053751A187623EA11D842C9
Malicious:	false
Preview:	{"logTime": "0904/030300", "correlationVector":"E84612C1CEE9414C91F3B446948AE1D2","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0904/030310", "correlationVector":"kDV6j/0HnkLLPbqlY3xOu/","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0904/030310", "correlationVector":"2A6F3BD3DA314C5FA640A2A9FDF14DD5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0904/030310", "correlationVector":"PLv1kfp2Cqs/R4Pe8oDocQ","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\e8bf5f64-b734-4301-aafb-5b951f8d57f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\65344d01-2637-4729-a056-7d99b8167da7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1086337012\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1447482995\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1447482995\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1447482995\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1447482995\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir9152_1447482995\e8bf5f64-b734-4301-aafb-5b951f8d57f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.50545809966267
Encrypted:	false
SSDEEP:	48:uE9vWdOx9UsJdr7AzBdLXuHMkDp42A5rdOxeUsJdr7AzngdLXuHMk+21:Vg3uskDTegnIuskz
MD5:	6980CDAF8FF1CE9D8D02C4DAE9B36B9B
SHA1:	4A8A53902DBC6DCA1F0D69A53130BF2881E93B18
SHA-256:	C4651C19954080F88D378AF9B0C7F0F5E4E1E7364EF311926745634273D74AD4
SHA-512:	3675BDF32DAFD1744B9A07112C8C7BD2817392C0AF9DC1BC178FF1E066BFFFD9398B9E817CB484CBACECFB9090E155993DD1C59438B66A17F23930BB93CAB796
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...e...v....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWR`..PROGRA~2.........O.IDWR`....................V......v..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.$Y\............................2..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.$Y\...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.$Y\.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........Cm.Z.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MGETWF0J8SX93MI007KE.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.500999736982146
Encrypted:	false
SSDEEP:	48:uE5rdOxeUsJdr7AzBdLXuHMkDp42A5rdOxeUsJdr7AzngdLXuHMk+21:tg3uskDTegnIuskz
MD5:	E4F226634819B0CB3810596A818A4978
SHA1:	6AFB8090C91E42BCCA613802BB289C5C47AD51E1
SHA-256:	84A557B56B070FDDE52794A9785F3F57730A15683E97FDB6DB90C526853D3B93
SHA-512:	2359D505334452851A38C69F7A4331ED37E8F487EF8983B3C2F7B03F4D7EAA04A8F36CCBC7B81131641649A0AFD3FDCE39FC81E943732E079717715D150D76A2
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...e...v....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....$YY...PROGRA~2.........O.I$YY.....................V.....&.;.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.$Y\............................2..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.$Y`............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.$Y\...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.$Y\.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........Cm.Z.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QGE6C4FL8G4WWPBLSMO0.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.50545809966267
Encrypted:	false
SSDEEP:	48:uE9vWdOx9UsJdr7AzBdLXuHMkDp42A5rdOxeUsJdr7AzngdLXuHMk+21:Vg3uskDTegnIuskz
MD5:	6980CDAF8FF1CE9D8D02C4DAE9B36B9B
SHA1:	4A8A53902DBC6DCA1F0D69A53130BF2881E93B18
SHA-256:	C4651C19954080F88D378AF9B0C7F0F5E4E1E7364EF311926745634273D74AD4
SHA-512:	3675BDF32DAFD1744B9A07112C8C7BD2817392C0AF9DC1BC178FF1E066BFFFD9398B9E817CB484CBACECFB9090E155993DD1C59438B66A17F23930BB93CAB796
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...e...v....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWR`..PROGRA~2.........O.IDWR`....................V......v..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.$Y\............................2..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.$Y\...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.$Y\.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........Cm.Z.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.500999736982146
Encrypted:	false
SSDEEP:	48:uE5rdOxeUsJdr7AzBdLXuHMkDp42A5rdOxeUsJdr7AzngdLXuHMk+21:tg3uskDTegnIuskz
MD5:	E4F226634819B0CB3810596A818A4978
SHA1:	6AFB8090C91E42BCCA613802BB289C5C47AD51E1
SHA-256:	84A557B56B070FDDE52794A9785F3F57730A15683E97FDB6DB90C526853D3B93
SHA-512:	2359D505334452851A38C69F7A4331ED37E8F487EF8983B3C2F7B03F4D7EAA04A8F36CCBC7B81131641649A0AFD3FDCE39FC81E943732E079717715D150D76A2
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...e...v....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....$YY...PROGRA~2.........O.I$YY.....................V.....&.;.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.$Y\............................2..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.$Y`............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.$Y\...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.$Y\.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........Cm.Z.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579783452448297
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	437238e0e1120fa6ff1f6d4b4c1f4dd4
SHA1:	5a6fd403d8636c0f4c5d532598f85ea6c1aca592
SHA256:	a4cc4007a18e58073baef163f09a0238927ac8e7765ab861130f98e25151945c
SHA512:	d996c6e00642115121a19537a7ae390deb01d6b586a8322f26d98493a211e399f1437c38845c68c63e4116940d60e7ba957ef277ace873cafd7de91605458e1b
SSDEEP:	12288:mqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTw:mqDEvCTbMWu7rQYlBQcBiT6rprG8asw
TLSH:	08159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D7CD37 [Wed Sep 4 03:00:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FC6744CE863h
jmp 00007FC6744CE16Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FC6744CE34Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FC6744CE31Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FC6744D0F0Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FC6744D0F58h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FC6744D0F41h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	6cb6b27fcbc09277f772a88b536c29af	False	0.28692708333333333	data	5.165591115924857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 4, 2024 05:02:50.186636925 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 4, 2024 05:02:59.842647076 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 4, 2024 05:03:01.571774006 CEST	49744	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:01.571805000 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:01.571810007 CEST	443	49744	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:01.571826935 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:01.571877956 CEST	49744	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:01.571973085 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:01.572093010 CEST	49744	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:01.572102070 CEST	443	49744	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:01.572278976 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:01.572292089 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.210186005 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.210510969 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.210527897 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.211484909 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.211647034 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.212658882 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.212658882 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.212671995 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.212728977 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.241636992 CEST	443	49744	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.241894007 CEST	49744	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.241915941 CEST	443	49744	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.243057966 CEST	443	49744	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.243244886 CEST	49744	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.243469954 CEST	49744	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.243469954 CEST	49744	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.243479967 CEST	443	49744	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.243531942 CEST	443	49744	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.313256979 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.313275099 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.313391924 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.313415051 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.313514948 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.348551989 CEST	443	49744	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.348598957 CEST	443	49744	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.348633051 CEST	443	49744	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.348642111 CEST	49744	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.348732948 CEST	49744	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.350027084 CEST	49744	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.350042105 CEST	443	49744	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.398829937 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.398842096 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.398874044 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.398885965 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.398901939 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.398910999 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.398956060 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.400974035 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.400996923 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.401009083 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.401021957 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.401027918 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.401096106 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.484350920 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.484366894 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.484452009 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.484461069 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.484596014 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.484638929 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.484646082 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.484661102 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.484719992 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.509464979 CEST	49745	443	192.168.2.4	13.107.246.57
Sep 4, 2024 05:03:02.509489059 CEST	443	49745	13.107.246.57	192.168.2.4
Sep 4, 2024 05:03:02.850470066 CEST	49749	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:02.850524902 CEST	443	49749	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:02.850577116 CEST	49749	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:02.851006031 CEST	49749	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:02.851018906 CEST	443	49749	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:02.851628065 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:02.851635933 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:02.851691008 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:02.855853081 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:02.855860949 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:02.855921030 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:02.856153965 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:02.856164932 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:02.856583118 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:02.856589079 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:02.856636047 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:02.857038021 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:02.857048035 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:02.857189894 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:02.857199907 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:02.929303885 CEST	49753	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:02.929331064 CEST	443	49753	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:02.929398060 CEST	49753	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:02.930064917 CEST	49753	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:02.930073023 CEST	443	49753	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.313445091 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.313657999 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.313672066 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.314712048 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.314768076 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.316173077 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.316240072 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.316401005 CEST	443	49749	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.316505909 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.316513062 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.316641092 CEST	49749	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.316647053 CEST	443	49749	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.317620993 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.317780972 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.317786932 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.317795038 CEST	443	49749	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.317852974 CEST	49749	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.318730116 CEST	49749	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.318808079 CEST	443	49749	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.318876982 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.318916082 CEST	49749	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.318921089 CEST	443	49749	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.318936110 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.319844961 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.319902897 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.320014954 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.320019960 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.329286098 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.329458952 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.329467058 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.330440998 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.330492973 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.331368923 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.331429958 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.331552029 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.331557035 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.372672081 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.388323069 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.388323069 CEST	49749	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.388323069 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.401415110 CEST	443	49753	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.405128956 CEST	49753	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.405147076 CEST	443	49753	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.406156063 CEST	443	49753	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.406241894 CEST	49753	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.407259941 CEST	49753	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.407259941 CEST	49753	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.407330036 CEST	443	49753	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.430608988 CEST	443	49749	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.430664062 CEST	443	49749	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.433017969 CEST	49749	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.434745073 CEST	49749	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.434756041 CEST	443	49749	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.445708036 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.445766926 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.448374033 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.448889017 CEST	49751	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.448894978 CEST	443	49751	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.448951960 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.449023008 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.449126959 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.449676037 CEST	49750	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:03.449680090 CEST	443	49750	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:03.450702906 CEST	49753	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.450717926 CEST	443	49753	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.463449955 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.463515997 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.464194059 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.464385033 CEST	49752	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.464392900 CEST	443	49752	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.498383999 CEST	49753	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.526149035 CEST	443	49753	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.526226044 CEST	443	49753	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.526277065 CEST	49753	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.526953936 CEST	49753	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:03.526966095 CEST	443	49753	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:03.645019054 CEST	49756	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:03.645055056 CEST	443	49756	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:03.649175882 CEST	49756	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:03.650480032 CEST	49756	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:03.650494099 CEST	443	49756	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:04.049020052 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.049038887 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.049189091 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.049319983 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.049330950 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.049391031 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.049638033 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.049638033 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.049649954 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.049662113 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.289547920 CEST	49759	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.289576054 CEST	443	49759	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.289633989 CEST	49760	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.289659023 CEST	443	49760	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.289720058 CEST	49761	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.289722919 CEST	49759	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.289738894 CEST	443	49761	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.289753914 CEST	49760	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.289849043 CEST	49761	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.290107012 CEST	49761	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.290117979 CEST	443	49761	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.290247917 CEST	49760	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.290266037 CEST	443	49760	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.290762901 CEST	49759	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.290777922 CEST	443	49759	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.311340094 CEST	443	49756	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:04.311511993 CEST	49756	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:04.315090895 CEST	49756	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:04.315099955 CEST	443	49756	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:04.315310001 CEST	443	49756	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:04.355423927 CEST	49756	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:04.396503925 CEST	443	49756	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:04.505865097 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.506108046 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.506119013 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.506441116 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.506789923 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.506843090 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.523116112 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.523315907 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.523323059 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.523646116 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.523957968 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.524014950 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.548984051 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.565860033 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.590164900 CEST	443	49756	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:04.590226889 CEST	443	49756	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:04.590270042 CEST	49756	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:04.590683937 CEST	49756	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:04.590698957 CEST	443	49756	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:04.590709925 CEST	49756	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:04.590715885 CEST	443	49756	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:04.634974957 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:04.635013103 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:04.635078907 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:04.635427952 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:04.635438919 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:04.851352930 CEST	443	49759	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.851391077 CEST	443	49761	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.852123022 CEST	443	49760	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.893980980 CEST	49761	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.893994093 CEST	49759	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.894090891 CEST	49760	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.950292110 CEST	49761	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.950310946 CEST	443	49761	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.950920105 CEST	443	49761	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.951962948 CEST	49759	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.951968908 CEST	443	49759	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.952351093 CEST	49760	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.952362061 CEST	443	49760	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.952866077 CEST	443	49760	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.953229904 CEST	443	49759	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.953286886 CEST	49759	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.953624964 CEST	49761	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.953697920 CEST	443	49761	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.954636097 CEST	49760	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.954705954 CEST	443	49760	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:04.964020967 CEST	49759	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:04.964145899 CEST	443	49759	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:05.005445004 CEST	49761	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:05.005472898 CEST	49760	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:05.005475998 CEST	49759	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:05.005485058 CEST	443	49759	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:05.047274113 CEST	49759	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:05.470551014 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:05.470640898 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:05.473777056 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:05.473788023 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:05.474097013 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:05.484097958 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:05.524509907 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:05.747863054 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:05.747951031 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:05.748465061 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:05.797277927 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:05.797277927 CEST	49762	443	192.168.2.4	184.28.90.27
Sep 4, 2024 05:03:05.797332048 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:05.797347069 CEST	443	49762	184.28.90.27	192.168.2.4
Sep 4, 2024 05:03:05.892644882 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:05.892676115 CEST	443	49763	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:05.892815113 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:05.892991066 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:05.893018007 CEST	443	49764	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:05.893074036 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:05.894352913 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:05.894364119 CEST	443	49763	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:05.894516945 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:05.894530058 CEST	443	49764	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.270718098 CEST	49765	443	192.168.2.4	142.250.72.100
Sep 4, 2024 05:03:06.270736933 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.270837069 CEST	49765	443	192.168.2.4	142.250.72.100
Sep 4, 2024 05:03:06.271022081 CEST	49765	443	192.168.2.4	142.250.72.100
Sep 4, 2024 05:03:06.271037102 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.360208035 CEST	443	49764	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.360474110 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.360491037 CEST	443	49764	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.360810041 CEST	443	49764	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.360867023 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.361414909 CEST	443	49764	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.361469984 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.362711906 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.362763882 CEST	443	49764	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.362989902 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.383519888 CEST	443	49763	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.383738995 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.383759022 CEST	443	49763	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.384207964 CEST	443	49763	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.384277105 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.384965897 CEST	443	49763	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.385013103 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.385155916 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.385224104 CEST	443	49763	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.385310888 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.385318995 CEST	443	49763	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.405057907 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.405066013 CEST	443	49764	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.436502934 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.453286886 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.472168922 CEST	443	49764	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.472347021 CEST	443	49764	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.472397089 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.472992897 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.473005056 CEST	443	49764	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.473012924 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.473047972 CEST	49764	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.504990101 CEST	443	49763	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.505397081 CEST	443	49763	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.505448103 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.505660057 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.505672932 CEST	443	49763	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.505681038 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.505918980 CEST	49763	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.764592886 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.765043974 CEST	49765	443	192.168.2.4	142.250.72.100
Sep 4, 2024 05:03:06.765063047 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.766174078 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.766225100 CEST	49765	443	192.168.2.4	142.250.72.100
Sep 4, 2024 05:03:06.767304897 CEST	49765	443	192.168.2.4	142.250.72.100
Sep 4, 2024 05:03:06.767366886 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.767494917 CEST	49765	443	192.168.2.4	142.250.72.100
Sep 4, 2024 05:03:06.767508030 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.781445980 CEST	49766	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.781466007 CEST	443	49766	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.781598091 CEST	49766	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.781919003 CEST	49766	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.781930923 CEST	443	49766	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.810591936 CEST	49765	443	192.168.2.4	142.250.72.100
Sep 4, 2024 05:03:06.810920000 CEST	49767	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.810942888 CEST	443	49767	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.811045885 CEST	49767	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.811222076 CEST	49767	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.811234951 CEST	443	49767	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.878390074 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.878443956 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.878496885 CEST	49765	443	192.168.2.4	142.250.72.100
Sep 4, 2024 05:03:06.878503084 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.878514051 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.878554106 CEST	49765	443	192.168.2.4	142.250.72.100
Sep 4, 2024 05:03:06.878561020 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.878670931 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:06.878741980 CEST	49765	443	192.168.2.4	142.250.72.100
Sep 4, 2024 05:03:06.879381895 CEST	49765	443	192.168.2.4	142.250.72.100
Sep 4, 2024 05:03:06.879389048 CEST	443	49765	142.250.72.100	192.168.2.4
Sep 4, 2024 05:03:07.244422913 CEST	443	49766	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.244754076 CEST	49766	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.244765043 CEST	443	49766	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.245192051 CEST	443	49766	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.245249033 CEST	49766	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.245949984 CEST	443	49766	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.246009111 CEST	49766	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.246170998 CEST	49766	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.246226072 CEST	443	49766	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.276670933 CEST	443	49767	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.276962996 CEST	49767	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.276973009 CEST	443	49767	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.277276993 CEST	443	49767	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.277335882 CEST	49767	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.277887106 CEST	443	49767	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.277940989 CEST	49767	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.278217077 CEST	49767	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.278266907 CEST	443	49767	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.295144081 CEST	49766	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.295150995 CEST	443	49766	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.326378107 CEST	49767	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.326384068 CEST	443	49767	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.342006922 CEST	49766	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.373250008 CEST	49767	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:11.813477993 CEST	49774	443	192.168.2.4	13.107.246.60
Sep 4, 2024 05:03:11.813503027 CEST	443	49774	13.107.246.60	192.168.2.4
Sep 4, 2024 05:03:11.813810110 CEST	49774	443	192.168.2.4	13.107.246.60
Sep 4, 2024 05:03:11.813982010 CEST	49774	443	192.168.2.4	13.107.246.60
Sep 4, 2024 05:03:11.814006090 CEST	443	49774	13.107.246.60	192.168.2.4
Sep 4, 2024 05:03:11.847491026 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:11.847501040 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:11.847660065 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:11.847851038 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:11.847863913 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.459738016 CEST	443	49774	13.107.246.60	192.168.2.4
Sep 4, 2024 05:03:12.460349083 CEST	49774	443	192.168.2.4	13.107.246.60
Sep 4, 2024 05:03:12.460364103 CEST	443	49774	13.107.246.60	192.168.2.4
Sep 4, 2024 05:03:12.461276054 CEST	443	49774	13.107.246.60	192.168.2.4
Sep 4, 2024 05:03:12.461342096 CEST	49774	443	192.168.2.4	13.107.246.60
Sep 4, 2024 05:03:12.462564945 CEST	49774	443	192.168.2.4	13.107.246.60
Sep 4, 2024 05:03:12.462618113 CEST	443	49774	13.107.246.60	192.168.2.4
Sep 4, 2024 05:03:12.462723017 CEST	49774	443	192.168.2.4	13.107.246.60
Sep 4, 2024 05:03:12.462732077 CEST	443	49774	13.107.246.60	192.168.2.4
Sep 4, 2024 05:03:12.482911110 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:12.482950926 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:12.483002901 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:12.486073971 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:12.486087084 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:12.508661032 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.509166002 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.509176016 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.509524107 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.509535074 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.509574890 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.509582043 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.509618998 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.510200024 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.518253088 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.518321991 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.525269032 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.525276899 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.564047098 CEST	443	49774	13.107.246.60	192.168.2.4
Sep 4, 2024 05:03:12.564085960 CEST	443	49774	13.107.246.60	192.168.2.4
Sep 4, 2024 05:03:12.564101934 CEST	443	49774	13.107.246.60	192.168.2.4
Sep 4, 2024 05:03:12.564112902 CEST	49774	443	192.168.2.4	13.107.246.60
Sep 4, 2024 05:03:12.564153910 CEST	49774	443	192.168.2.4	13.107.246.60
Sep 4, 2024 05:03:12.566884041 CEST	49774	443	192.168.2.4	13.107.246.60
Sep 4, 2024 05:03:12.566895962 CEST	443	49774	13.107.246.60	192.168.2.4
Sep 4, 2024 05:03:12.581769943 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.645940065 CEST	49672	443	192.168.2.4	173.222.162.32
Sep 4, 2024 05:03:12.645968914 CEST	443	49672	173.222.162.32	192.168.2.4
Sep 4, 2024 05:03:12.777066946 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.777101994 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.777148008 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.777160883 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.779805899 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.779853106 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.779860973 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.789288044 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.789340019 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.789346933 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.795520067 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.795547962 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.795567989 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.795574903 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.795618057 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.801700115 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.807931900 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.807957888 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.807981014 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.807988882 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.808028936 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.814150095 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.862495899 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.862544060 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.862552881 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.867543936 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.867573977 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.867598057 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.867609024 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.867614031 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.867647886 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.871829987 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.871881962 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.871887922 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.878031969 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.878082037 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.878088951 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.884423018 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.884474993 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.884485006 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.890563965 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.890609980 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.890615940 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.896951914 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.897010088 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.897017956 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.904654980 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.904705048 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.904711962 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.910227060 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.910274982 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.910280943 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.915750027 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.915796995 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.915805101 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.921757936 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.921804905 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.921813011 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.928966045 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.929019928 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.929027081 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.935126066 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.935184002 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.935192108 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.940768003 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.940819979 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.940828085 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.951354980 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.951381922 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.951396942 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.951404095 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.951442957 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.958025932 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.958101034 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.958142996 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.958149910 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.958364964 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.958410978 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.958415985 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.961811066 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.961853027 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.961863995 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.967242002 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.967283010 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.967309952 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.967315912 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.967371941 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.970365047 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.973859072 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.973902941 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.973903894 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.973917007 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.973953009 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.977356911 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.981121063 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.981153011 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.981168032 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.981174946 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.981333017 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.984168053 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.987473965 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.987528086 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.987535000 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.990988016 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.991035938 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.991043091 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.994368076 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.994406939 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.994417906 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.997840881 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.997874975 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.997888088 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:12.997895002 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:12.997945070 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.001167059 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.004832983 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.004868031 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.004877090 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.004883051 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.004926920 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.008045912 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.011452913 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.011497974 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.011506081 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.015794992 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.015840054 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.015846968 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.019501925 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.019551039 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.019557953 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.024241924 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.024279118 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.024291039 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.024301052 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.024338961 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.025430918 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.029421091 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.029465914 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.029474020 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.031280994 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.031330109 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.031337023 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.038952112 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.038990021 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.039005041 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.039011955 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.039052010 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.039057970 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.039336920 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.039377928 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.039385080 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.039653063 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.039693117 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.040005922 CEST	49775	443	192.168.2.4	142.250.181.225
Sep 4, 2024 05:03:13.040014982 CEST	443	49775	142.250.181.225	192.168.2.4
Sep 4, 2024 05:03:13.268167019 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:13.268223047 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:13.271842957 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:13.271850109 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:13.272121906 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:13.404918909 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:14.028845072 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:14.072504044 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.285927057 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.285950899 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.285959959 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.285986900 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.286000013 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.286010981 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.286020041 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:14.286045074 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.286057949 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:14.286106110 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:14.286106110 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:14.286670923 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.286679029 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.286798000 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:14.286804914 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.286904097 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.287184000 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:14.942224979 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:14.942256927 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:14.942270994 CEST	49777	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:14.942276955 CEST	443	49777	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:15.237503052 CEST	49782	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.237534046 CEST	443	49782	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.237593889 CEST	49782	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.237796068 CEST	49782	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.237811089 CEST	443	49782	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.238200903 CEST	49783	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.238218069 CEST	443	49783	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.238270998 CEST	49783	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.238428116 CEST	49783	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.238439083 CEST	443	49783	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.290256023 CEST	49784	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:15.290275097 CEST	443	49784	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:15.290360928 CEST	49784	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:15.290980101 CEST	49784	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:15.290993929 CEST	443	49784	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:15.692837954 CEST	443	49782	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.693209887 CEST	49782	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.693229914 CEST	443	49782	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.694302082 CEST	443	49782	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.694361925 CEST	49782	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.695839882 CEST	49782	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.695902109 CEST	443	49782	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.696175098 CEST	49782	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.696182966 CEST	443	49782	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.703274012 CEST	443	49783	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.703479052 CEST	49783	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.703493118 CEST	443	49783	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.704350948 CEST	443	49783	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.704423904 CEST	49783	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.705267906 CEST	49783	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.705324888 CEST	443	49783	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.705501080 CEST	49783	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.705507040 CEST	443	49783	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.744163036 CEST	443	49784	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:15.744364023 CEST	49784	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:15.744374037 CEST	443	49784	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:15.745397091 CEST	443	49784	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:15.745455980 CEST	49784	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:15.746678114 CEST	49784	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:15.746747971 CEST	443	49784	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:15.746826887 CEST	49784	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:15.746834040 CEST	443	49784	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:15.832418919 CEST	443	49782	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.832501888 CEST	49782	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.839912891 CEST	443	49783	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.839979887 CEST	49783	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.848265886 CEST	49782	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.848277092 CEST	443	49782	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.848666906 CEST	49783	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:15.848684072 CEST	443	49783	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:15.866525888 CEST	443	49784	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:15.866586924 CEST	49784	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:15.866750002 CEST	49784	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:15.866756916 CEST	443	49784	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:19.415246964 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:19.415328979 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:19.415410042 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:19.433466911 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:19.433533907 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:19.433681011 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:28.817730904 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:28.817756891 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:28.817940950 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:28.817941904 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:28.817955017 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:28.818008900 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:28.818208933 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:28.818208933 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:28.818222046 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:28.818223953 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.292903900 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.297471046 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.297486067 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.297854900 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.298324108 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.298393011 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.299366951 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.299607992 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.299626112 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.299957991 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.300282001 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.300352097 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.339710951 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.362932920 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.372189999 CEST	49789	443	192.168.2.4	23.200.0.42
Sep 4, 2024 05:03:29.372209072 CEST	443	49789	23.200.0.42	192.168.2.4
Sep 4, 2024 05:03:29.372433901 CEST	49789	443	192.168.2.4	23.200.0.42
Sep 4, 2024 05:03:29.372433901 CEST	49789	443	192.168.2.4	23.200.0.42
Sep 4, 2024 05:03:29.372456074 CEST	443	49789	23.200.0.42	192.168.2.4
Sep 4, 2024 05:03:29.852185965 CEST	443	49789	23.200.0.42	192.168.2.4
Sep 4, 2024 05:03:29.852484941 CEST	49789	443	192.168.2.4	23.200.0.42
Sep 4, 2024 05:03:29.852497101 CEST	443	49789	23.200.0.42	192.168.2.4
Sep 4, 2024 05:03:29.852822065 CEST	443	49789	23.200.0.42	192.168.2.4
Sep 4, 2024 05:03:29.853111029 CEST	49789	443	192.168.2.4	23.200.0.42
Sep 4, 2024 05:03:29.853171110 CEST	443	49789	23.200.0.42	192.168.2.4
Sep 4, 2024 05:03:29.853411913 CEST	49789	443	192.168.2.4	23.200.0.42
Sep 4, 2024 05:03:29.900490999 CEST	443	49789	23.200.0.42	192.168.2.4
Sep 4, 2024 05:03:30.007045031 CEST	443	49789	23.200.0.42	192.168.2.4
Sep 4, 2024 05:03:30.007133007 CEST	443	49789	23.200.0.42	192.168.2.4
Sep 4, 2024 05:03:30.007186890 CEST	49789	443	192.168.2.4	23.200.0.42
Sep 4, 2024 05:03:30.007399082 CEST	49789	443	192.168.2.4	23.200.0.42
Sep 4, 2024 05:03:30.007410049 CEST	443	49789	23.200.0.42	192.168.2.4
Sep 4, 2024 05:03:30.020941019 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.020963907 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.021111965 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.021188021 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.021207094 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.021255970 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.021439075 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.021450996 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.021589041 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.021599054 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.472994089 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.473328114 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.473339081 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.474217892 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.474622011 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.474749088 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.481543064 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.481796980 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.481817007 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.482137918 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.482914925 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.482979059 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.514532089 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.530278921 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.570604086 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 4, 2024 05:03:30.570648909 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:30.571049929 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 4, 2024 05:03:30.574012995 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 4, 2024 05:03:30.574029922 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.128160000 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.128547907 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 4, 2024 05:03:31.128568888 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.129525900 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.129638910 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 4, 2024 05:03:31.130714893 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 4, 2024 05:03:31.130774975 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.130896091 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 4, 2024 05:03:31.130902052 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.174745083 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 4, 2024 05:03:31.229571104 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.230001926 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.230015039 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.230029106 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.230053902 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 4, 2024 05:03:31.230065107 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.230084896 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.230099916 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 4, 2024 05:03:31.230185032 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 4, 2024 05:03:31.231744051 CEST	49792	443	192.168.2.4	152.195.19.97
Sep 4, 2024 05:03:31.231758118 CEST	443	49792	152.195.19.97	192.168.2.4
Sep 4, 2024 05:03:31.803170919 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:31.803205967 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:31.803282022 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:31.803601980 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:31.803610086 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:31.803769112 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:31.803778887 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:31.803807020 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:31.803919077 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:31.803930044 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.270392895 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.270611048 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.270632029 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.270915985 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.271187067 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.271244049 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.277456999 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.277640104 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.277648926 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.277976990 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.278312922 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.278373957 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.326235056 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.326445103 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:44.198587894 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:44.198666096 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:44.198712111 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:44.205744982 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:44.205811977 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:44.205854893 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:45.384032965 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:45.384107113 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:45.384151936 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:45.391685963 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:45.391741037 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:45.391793013 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:47.173059940 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:47.173124075 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:47.173177004 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:47.182033062 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:47.182111979 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:47.182153940 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:49.967154980 CEST	49760	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:49.967158079 CEST	49761	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:49.967166901 CEST	443	49760	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:49.967174053 CEST	443	49761	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:50.012666941 CEST	49759	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:03:50.012677908 CEST	443	49759	142.251.41.3	192.168.2.4
Sep 4, 2024 05:03:51.452565908 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:51.452599049 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:51.452672005 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:51.453023911 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:51.453042984 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.256787062 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.256964922 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:52.260524988 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:52.260536909 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.260763884 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.268752098 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:52.310265064 CEST	49766	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:52.310281038 CEST	443	49766	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:52.312504053 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.341368914 CEST	49767	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:52.341377020 CEST	443	49767	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:52.599895954 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.599931002 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.599951029 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.599986076 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:52.600004911 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.600017071 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:52.600049019 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:52.600912094 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.600950003 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.600972891 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:52.600980043 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.600999117 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.601003885 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:52.601043940 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:52.604768038 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:52.604780912 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:52.604814053 CEST	49797	443	192.168.2.4	40.68.123.157
Sep 4, 2024 05:03:52.604819059 CEST	443	49797	40.68.123.157	192.168.2.4
Sep 4, 2024 05:03:56.662570953 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:56.662615061 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:56.662667036 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:56.662849903 CEST	49799	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:56.662883043 CEST	443	49799	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:56.662930012 CEST	49799	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:56.663081884 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:56.663094997 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:56.663197041 CEST	49799	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:56.663207054 CEST	443	49799	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.124753952 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.125067949 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.125082970 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.125396013 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.125828981 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.125909090 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.147001028 CEST	443	49799	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.147197962 CEST	49799	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.147218943 CEST	443	49799	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.147533894 CEST	443	49799	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.147802114 CEST	49799	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.147859097 CEST	443	49799	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.172596931 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.188359976 CEST	49799	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:04:04.419998884 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:04:04.420033932 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 4, 2024 05:04:04.435611010 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:04:04.435619116 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 05:04:09.486061096 CEST	49794	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:04:09.486061096 CEST	49793	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:04:09.486095905 CEST	443	49794	162.159.61.3	192.168.2.4
Sep 4, 2024 05:04:09.486108065 CEST	443	49793	162.159.61.3	192.168.2.4
Sep 4, 2024 05:04:12.039695024 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 05:04:12.039766073 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 05:04:12.039817095 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:04:12.051393032 CEST	443	49799	172.64.41.3	192.168.2.4
Sep 4, 2024 05:04:12.051456928 CEST	443	49799	172.64.41.3	192.168.2.4
Sep 4, 2024 05:04:12.051525116 CEST	49799	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:04:29.200973034 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:04:29.201004982 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 4, 2024 05:04:29.216602087 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:04:29.216624022 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 4, 2024 05:04:30.389895916 CEST	49791	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:04:30.389926910 CEST	443	49791	162.159.61.3	192.168.2.4
Sep 4, 2024 05:04:30.405299902 CEST	49790	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:04:30.405329943 CEST	443	49790	162.159.61.3	192.168.2.4
Sep 4, 2024 05:04:34.981847048 CEST	49760	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:04:34.981849909 CEST	49761	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:04:34.981861115 CEST	443	49760	142.251.41.3	192.168.2.4
Sep 4, 2024 05:04:34.981870890 CEST	443	49761	142.251.41.3	192.168.2.4
Sep 4, 2024 05:04:35.013484955 CEST	49759	443	192.168.2.4	142.251.41.3
Sep 4, 2024 05:04:35.013497114 CEST	443	49759	142.251.41.3	192.168.2.4
Sep 4, 2024 05:04:37.312879086 CEST	49766	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:37.312901020 CEST	443	49766	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:37.344124079 CEST	49767	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:37.344147921 CEST	443	49767	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:49.424117088 CEST	49757	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:04:49.424154997 CEST	443	49757	162.159.61.3	192.168.2.4
Sep 4, 2024 05:04:49.439740896 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:04:49.439752102 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 05:04:57.044833899 CEST	49798	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:04:57.044884920 CEST	443	49798	172.64.41.3	192.168.2.4
Sep 4, 2024 05:04:57.060602903 CEST	49799	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:04:57.060636997 CEST	443	49799	172.64.41.3	192.168.2.4
Sep 4, 2024 05:04:59.546643972 CEST	49787	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:04:59.546669006 CEST	443	49787	172.64.41.3	192.168.2.4
Sep 4, 2024 05:04:59.546706915 CEST	49788	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:04:59.546735048 CEST	443	49788	172.64.41.3	192.168.2.4
Sep 4, 2024 05:05:00.230670929 CEST	49802	443	192.168.2.4	23.219.161.132
Sep 4, 2024 05:05:00.230705023 CEST	443	49802	23.219.161.132	192.168.2.4
Sep 4, 2024 05:05:00.230781078 CEST	49802	443	192.168.2.4	23.219.161.132
Sep 4, 2024 05:05:00.231007099 CEST	49802	443	192.168.2.4	23.219.161.132
Sep 4, 2024 05:05:00.231019020 CEST	443	49802	23.219.161.132	192.168.2.4
Sep 4, 2024 05:05:00.701210022 CEST	443	49802	23.219.161.132	192.168.2.4
Sep 4, 2024 05:05:00.701554060 CEST	49802	443	192.168.2.4	23.219.161.132
Sep 4, 2024 05:05:00.701565027 CEST	443	49802	23.219.161.132	192.168.2.4
Sep 4, 2024 05:05:00.701884031 CEST	443	49802	23.219.161.132	192.168.2.4
Sep 4, 2024 05:05:00.702172995 CEST	49802	443	192.168.2.4	23.219.161.132
Sep 4, 2024 05:05:00.702228069 CEST	443	49802	23.219.161.132	192.168.2.4
Sep 4, 2024 05:05:00.702310085 CEST	49802	443	192.168.2.4	23.219.161.132
Sep 4, 2024 05:05:00.744501114 CEST	443	49802	23.219.161.132	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 4, 2024 05:02:58.485872984 CEST	53	53010	1.1.1.1	192.168.2.4
Sep 4, 2024 05:02:59.522298098 CEST	55043	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:02:59.522448063 CEST	54659	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:01.859091043 CEST	53	55603	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:01.886709929 CEST	53	58794	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:02.842447042 CEST	62781	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:02.843173027 CEST	58464	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:02.843769073 CEST	62358	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:02.844108105 CEST	60441	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:02.844679117 CEST	55576	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:02.845057964 CEST	62031	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:02.845777035 CEST	50451	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:02.846229076 CEST	60264	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:02.849143028 CEST	53	62781	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:02.849775076 CEST	53	58464	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:02.850269079 CEST	53	62358	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:02.850591898 CEST	53	60441	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:02.851017952 CEST	53	55576	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:02.851557016 CEST	53	62031	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:02.852257967 CEST	53	50451	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:02.852977037 CEST	53	60264	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:02.921989918 CEST	53553	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:02.922121048 CEST	52182	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:02.928731918 CEST	53	52182	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:02.928821087 CEST	53	53553	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:03.734184980 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.048593998 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.183579922 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.183590889 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.183600903 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.183610916 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.183621883 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.183994055 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.185246944 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.185920954 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.186549902 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.186757088 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.186872005 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.279719114 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.279781103 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.279791117 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.279798985 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.280014992 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.280086040 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.280194044 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.281747103 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.283432007 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.283936024 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.289180994 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:04.377115965 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:04.402839899 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:05.480516911 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:05.480648994 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:05.575743914 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:05.576432943 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:05.576675892 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:05.576977015 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:05.773464918 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:05.773576021 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:05.868577957 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:05.869682074 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:05.870064020 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:05.891484022 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:06.173888922 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:06.174138069 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:06.268469095 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:06.269155979 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:06.269543886 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:06.270293951 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:06.474453926 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.781156063 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.922588110 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.922616959 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.923053980 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.929842949 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.929855108 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.929866076 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.929877043 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:06.930058956 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.930449963 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.931613922 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.931735039 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.932176113 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.932187080 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:06.951488018 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.029445887 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.029459000 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.029793024 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.030020952 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.044400930 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.044662952 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.045840025 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.065083981 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.065124989 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:07.065352917 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.092161894 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:07.162817001 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:11.839580059 CEST	63395	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:11.839766979 CEST	52245	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:11.846484900 CEST	53	63395	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:11.846946955 CEST	53	52245	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:12.079936028 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:12.080225945 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:12.176001072 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:12.177191973 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:12.177850008 CEST	443	54378	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:12.178226948 CEST	54378	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:12.179039955 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:12.179363012 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:12.635183096 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:12.635195971 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:12.635206938 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:12.635219097 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:12.635230064 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:12.635622978 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:12.636220932 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:12.636461020 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:12.739836931 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:12.739856005 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:12.739908934 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:12.740451097 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:12.779567957 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:12.802993059 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:12.803195000 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:12.803316116 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:12.803590059 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:12.804182053 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:12.935208082 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:14.937999964 CEST	53	53778	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:15.229815960 CEST	64608	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:15.229978085 CEST	50191	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:15.230510950 CEST	50570	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:15.230655909 CEST	50707	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:15.236454010 CEST	53	64608	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:15.236748934 CEST	53	50191	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:15.237097979 CEST	53	50570	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:15.237158060 CEST	53	50707	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:15.281622887 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:15.281665087 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:15.282995939 CEST	53236	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:15.283153057 CEST	50719	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:03:15.289566040 CEST	53	53236	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:15.289825916 CEST	53	50719	1.1.1.1	192.168.2.4
Sep 4, 2024 05:03:15.379996061 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:15.416887045 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:15.417021036 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:15.417160988 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:15.454276085 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:15.540050983 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:17.908961058 CEST	138	138	192.168.2.4	192.168.2.255
Sep 4, 2024 05:03:20.781563997 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:20.910883904 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:20.936815977 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:20.936830044 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:20.937280893 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:20.937731028 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:20.937844992 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:21.067363977 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:28.817287922 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.131021023 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.260766029 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.260782957 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.264317989 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.273348093 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.273418903 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.273430109 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.273789883 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.275135040 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.275671005 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.275671005 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.275926113 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.276045084 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.369364977 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.369497061 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.369507074 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.369515896 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.369957924 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.369957924 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.370296955 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.371248960 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.371469975 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.371795893 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:29.463865042 CEST	443	56065	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:29.499434948 CEST	56065	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:30.020591974 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.327159882 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.465122938 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.465234995 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.465368032 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.465379000 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.465389967 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.465756893 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.468167067 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.468641996 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.468866110 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.470037937 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.470037937 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.563771009 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.563781977 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.563797951 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.563807964 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.566416979 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.567631006 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.567759991 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.568931103 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.569533110 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.570600986 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:30.663970947 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:30.703080893 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:31.801249981 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:31.801501036 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:31.802798986 CEST	61287	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:31.897501945 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:31.898626089 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:31.899018049 CEST	443	57203	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:31.899235010 CEST	57203	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.113612890 CEST	61287	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.267595053 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.267612934 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.267623901 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.267703056 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.268158913 CEST	61287	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.269851923 CEST	61287	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.269958019 CEST	61287	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.270210028 CEST	61287	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.270288944 CEST	61287	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.493828058 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.493841887 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.493850946 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.493854046 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.493858099 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.493861914 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.493872881 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.493920088 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.494678974 CEST	61287	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.494798899 CEST	61287	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.495043039 CEST	61287	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:32.653052092 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.654050112 CEST	443	61287	162.159.61.3	192.168.2.4
Sep 4, 2024 05:03:32.654194117 CEST	61287	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:03:33.829659939 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:33.958765984 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:33.981986046 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:33.982383966 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:34.002942085 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:34.071048975 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:34.131678104 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:34.143003941 CEST	443	54297	172.253.115.84	192.168.2.4
Sep 4, 2024 05:03:34.143281937 CEST	54297	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:03:35.966197014 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:35.966197014 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:36.200990915 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:36.223800898 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:36.223814964 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:36.223823071 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:36.231250048 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:36.241838932 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:36.241975069 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:36.332398891 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:36.339262009 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:36.527090073 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:36.630707026 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:36.638856888 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:36.638869047 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:36.639113903 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:36.665272951 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:36.771759033 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:40.891793013 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:40.891824961 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:41.123424053 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:41.157305956 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:41.169133902 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:41.169238091 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:41.169398069 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:41.201433897 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:03:41.221280098 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:41.281246901 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:03:56.662319899 CEST	49999	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:56.969764948 CEST	49999	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.111433029 CEST	443	49999	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.111558914 CEST	443	49999	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.111576080 CEST	443	49999	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.111588001 CEST	443	49999	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.111598015 CEST	443	49999	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.111952066 CEST	49999	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.113619089 CEST	49999	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.113723993 CEST	49999	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.114038944 CEST	49999	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.114144087 CEST	49999	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.211160898 CEST	443	49999	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.211252928 CEST	443	49999	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.211399078 CEST	443	49999	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.211407900 CEST	443	49999	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.211551905 CEST	49999	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.211615086 CEST	49999	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.212532997 CEST	443	49999	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.212794065 CEST	443	49999	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.212914944 CEST	49999	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:03:57.307425022 CEST	443	49999	172.64.41.3	192.168.2.4
Sep 4, 2024 05:03:57.344701052 CEST	49999	443	192.168.2.4	172.64.41.3
Sep 4, 2024 05:04:06.910263062 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:06.910433054 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:07.008641005 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:07.022567987 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:07.022727013 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:07.022914886 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:07.061448097 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:07.146739960 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:08.285424948 CEST	63493	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:04:08.285552979 CEST	63493	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:04:08.739722967 CEST	443	63493	172.253.115.84	192.168.2.4
Sep 4, 2024 05:04:08.739742041 CEST	443	63493	172.253.115.84	192.168.2.4
Sep 4, 2024 05:04:08.739749908 CEST	443	63493	172.253.115.84	192.168.2.4
Sep 4, 2024 05:04:08.741575003 CEST	63493	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:04:08.741694927 CEST	63493	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:04:08.742552042 CEST	63493	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:04:08.764098883 CEST	443	63493	172.253.115.84	192.168.2.4
Sep 4, 2024 05:04:08.841885090 CEST	443	63493	172.253.115.84	192.168.2.4
Sep 4, 2024 05:04:08.841969013 CEST	443	63493	172.253.115.84	192.168.2.4
Sep 4, 2024 05:04:08.842454910 CEST	63493	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:04:08.885956049 CEST	443	63493	172.253.115.84	192.168.2.4
Sep 4, 2024 05:04:08.885968924 CEST	443	63493	172.253.115.84	192.168.2.4
Sep 4, 2024 05:04:08.886461020 CEST	63493	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:04:08.920384884 CEST	63493	443	192.168.2.4	172.253.115.84
Sep 4, 2024 05:04:09.012178898 CEST	443	63493	172.253.115.84	192.168.2.4
Sep 4, 2024 05:04:12.737127066 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:12.853024960 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:12.853437901 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:12.853775978 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:12.889458895 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:12.978056908 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:37.502965927 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:37.503017902 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:37.601401091 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:37.615144014 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:37.615308046 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:37.615437984 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:37.641163111 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:37.738553047 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:45.375588894 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:45.488605976 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:45.488692999 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:45.488971949 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:45.528950930 CEST	54823	443	192.168.2.4	142.251.35.174
Sep 4, 2024 05:04:45.612344027 CEST	443	54823	142.251.35.174	192.168.2.4
Sep 4, 2024 05:04:59.547266006 CEST	61974	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:04:59.547401905 CEST	49672	53	192.168.2.4	1.1.1.1
Sep 4, 2024 05:04:59.558588982 CEST	53	49672	1.1.1.1	192.168.2.4
Sep 4, 2024 05:04:59.558636904 CEST	53	61974	1.1.1.1	192.168.2.4
Sep 4, 2024 05:04:59.559535027 CEST	60158	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:04:59.559679031 CEST	60158	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:04:59.559850931 CEST	60158	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:04:59.559942961 CEST	60158	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:04:59.921274900 CEST	60158	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:05:00.029509068 CEST	443	60158	162.159.61.3	192.168.2.4
Sep 4, 2024 05:05:00.029557943 CEST	443	60158	162.159.61.3	192.168.2.4
Sep 4, 2024 05:05:00.029583931 CEST	443	60158	162.159.61.3	192.168.2.4
Sep 4, 2024 05:05:00.029592991 CEST	443	60158	162.159.61.3	192.168.2.4
Sep 4, 2024 05:05:00.029601097 CEST	443	60158	162.159.61.3	192.168.2.4
Sep 4, 2024 05:05:00.030477047 CEST	60158	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:05:00.030595064 CEST	60158	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:05:00.030653954 CEST	60158	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:05:00.030695915 CEST	60158	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:05:00.128575087 CEST	443	60158	162.159.61.3	192.168.2.4
Sep 4, 2024 05:05:00.131611109 CEST	443	60158	162.159.61.3	192.168.2.4
Sep 4, 2024 05:05:00.131859064 CEST	60158	443	192.168.2.4	162.159.61.3
Sep 4, 2024 05:05:00.228605986 CEST	443	60158	162.159.61.3	192.168.2.4
Sep 4, 2024 05:05:00.229615927 CEST	443	60158	162.159.61.3	192.168.2.4
Sep 4, 2024 05:05:00.230093002 CEST	443	60158	162.159.61.3	192.168.2.4
Sep 4, 2024 05:05:00.230264902 CEST	60158	443	192.168.2.4	162.159.61.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 4, 2024 05:03:03.451674938 CEST	192.168.2.4	1.1.1.1	c290	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 4, 2024 05:02:59.522298098 CEST	192.168.2.4	1.1.1.1	0x1b97	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:02:59.522448063 CEST	192.168.2.4	1.1.1.1	0x422c	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Sep 4, 2024 05:03:02.842447042 CEST	192.168.2.4	1.1.1.1	0xd0fd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.843173027 CEST	192.168.2.4	1.1.1.1	0x3185	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 05:03:02.843769073 CEST	192.168.2.4	1.1.1.1	0x83f5	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.844108105 CEST	192.168.2.4	1.1.1.1	0x2c7a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 05:03:02.844679117 CEST	192.168.2.4	1.1.1.1	0xa327	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.845057964 CEST	192.168.2.4	1.1.1.1	0x51bc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 05:03:02.845777035 CEST	192.168.2.4	1.1.1.1	0x1c27	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.846229076 CEST	192.168.2.4	1.1.1.1	0x4341	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 05:03:02.921989918 CEST	192.168.2.4	1.1.1.1	0xb548	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.922121048 CEST	192.168.2.4	1.1.1.1	0x2822	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 05:03:11.839580059 CEST	192.168.2.4	1.1.1.1	0x72e9	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:11.839766979 CEST	192.168.2.4	1.1.1.1	0x28aa	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Sep 4, 2024 05:03:15.229815960 CEST	192.168.2.4	1.1.1.1	0xe606	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:15.229978085 CEST	192.168.2.4	1.1.1.1	0x54dd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 05:03:15.230510950 CEST	192.168.2.4	1.1.1.1	0x7a5f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:15.230655909 CEST	192.168.2.4	1.1.1.1	0xdf13	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 05:03:15.282995939 CEST	192.168.2.4	1.1.1.1	0xed78	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:15.283153057 CEST	192.168.2.4	1.1.1.1	0xe233	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 05:04:59.547266006 CEST	192.168.2.4	1.1.1.1	0x764a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:04:59.547401905 CEST	192.168.2.4	1.1.1.1	0x159	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 4, 2024 05:02:59.528809071 CEST	1.1.1.1	192.168.2.4	0x1b97	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:02:59.529704094 CEST	1.1.1.1	192.168.2.4	0x422c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:01.571223021 CEST	1.1.1.1	192.168.2.4	0x236a	No error (0)	shed.dual-low.s-part-0029.t-0009.t-msedge.net	s-part-0029.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:01.571223021 CEST	1.1.1.1	192.168.2.4	0x236a	No error (0)	s-part-0029.t-0009.t-msedge.net		13.107.246.57	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.849143028 CEST	1.1.1.1	192.168.2.4	0xd0fd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.849143028 CEST	1.1.1.1	192.168.2.4	0xd0fd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.849775076 CEST	1.1.1.1	192.168.2.4	0x3185	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 05:03:02.850269079 CEST	1.1.1.1	192.168.2.4	0x83f5	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.850269079 CEST	1.1.1.1	192.168.2.4	0x83f5	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.850591898 CEST	1.1.1.1	192.168.2.4	0x2c7a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 05:03:02.851017952 CEST	1.1.1.1	192.168.2.4	0xa327	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.851017952 CEST	1.1.1.1	192.168.2.4	0xa327	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.851557016 CEST	1.1.1.1	192.168.2.4	0x51bc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 05:03:02.852257967 CEST	1.1.1.1	192.168.2.4	0x1c27	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.852257967 CEST	1.1.1.1	192.168.2.4	0x1c27	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.852977037 CEST	1.1.1.1	192.168.2.4	0x4341	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 05:03:02.928731918 CEST	1.1.1.1	192.168.2.4	0x2822	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 05:03:02.928821087 CEST	1.1.1.1	192.168.2.4	0xb548	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:02.928821087 CEST	1.1.1.1	192.168.2.4	0xb548	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:11.812868118 CEST	1.1.1.1	192.168.2.4	0x7a17	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:11.812868118 CEST	1.1.1.1	192.168.2.4	0x7a17	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:11.846484900 CEST	1.1.1.1	192.168.2.4	0x72e9	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:11.846484900 CEST	1.1.1.1	192.168.2.4	0x72e9	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.225	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:11.846946955 CEST	1.1.1.1	192.168.2.4	0x28aa	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:13.065850973 CEST	1.1.1.1	192.168.2.4	0x417a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:13.094531059 CEST	1.1.1.1	192.168.2.4	0xf9aa	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:13.094531059 CEST	1.1.1.1	192.168.2.4	0xf9aa	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:14.103826046 CEST	1.1.1.1	192.168.2.4	0xd944	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:14.111439943 CEST	1.1.1.1	192.168.2.4	0x39c4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:14.111439943 CEST	1.1.1.1	192.168.2.4	0x39c4	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:15.236454010 CEST	1.1.1.1	192.168.2.4	0xe606	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:15.236454010 CEST	1.1.1.1	192.168.2.4	0xe606	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:15.236748934 CEST	1.1.1.1	192.168.2.4	0x54dd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 05:03:15.237097979 CEST	1.1.1.1	192.168.2.4	0x7a5f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:15.237097979 CEST	1.1.1.1	192.168.2.4	0x7a5f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:15.237158060 CEST	1.1.1.1	192.168.2.4	0xdf13	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 05:03:15.289566040 CEST	1.1.1.1	192.168.2.4	0xed78	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:15.289566040 CEST	1.1.1.1	192.168.2.4	0xed78	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:15.289825916 CEST	1.1.1.1	192.168.2.4	0xe233	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 05:03:16.137501001 CEST	1.1.1.1	192.168.2.4	0xe4f5	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:16.137501001 CEST	1.1.1.1	192.168.2.4	0xe4f5	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:17.146092892 CEST	1.1.1.1	192.168.2.4	0xe4f5	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:17.146092892 CEST	1.1.1.1	192.168.2.4	0xe4f5	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:18.146254063 CEST	1.1.1.1	192.168.2.4	0xe4f5	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:18.146254063 CEST	1.1.1.1	192.168.2.4	0xe4f5	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:20.161111116 CEST	1.1.1.1	192.168.2.4	0xe4f5	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:20.161111116 CEST	1.1.1.1	192.168.2.4	0xe4f5	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:03:24.162862062 CEST	1.1.1.1	192.168.2.4	0xe4f5	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 05:03:24.162862062 CEST	1.1.1.1	192.168.2.4	0xe4f5	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:04:59.558588982 CEST	1.1.1.1	192.168.2.4	0x159	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 05:04:59.558636904 CEST	1.1.1.1	192.168.2.4	0x764a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 05:04:59.558636904 CEST	1.1.1.1	192.168.2.4	0x764a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

clients2.googleusercontent.com

slscr.update.microsoft.com

bzib.nelreports.net

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	13.107.246.57	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:02 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 03:03:02 UTC	576	IN	HTTP/1.1 200 OK Date: Wed, 04 Sep 2024 03:03:02 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 3afe9785-e01e-0066-3464-fbda5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240904T030302Z-165795675767jvm9z21nmtw4wn0000000a5g000000003c83 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-04 03:03:02 UTC	15808	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-09-04 03:03:02 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-09-04 03:03:02 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-09-04 03:03:02 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-09-04 03:03:02 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49744	13.107.246.57	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:02 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 03:03:02 UTC	552	IN	HTTP/1.1 200 OK Date: Wed, 04 Sep 2024 03:03:02 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 30 Aug 2024 17:05:10 GMT ETag: 0x8DCC915E7CD8385 x-ms-request-id: 1b6aa40f-801e-0039-70c1-fc28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240904T030302Z-16579567576p25xcxh3nycmsaw0000000a20000000001wpu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-04 03:03:02 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49750	172.64.41.3	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 03:03:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 03:03:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 03:03:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdabe864a56c346-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 03:03:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 29 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom) c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49749	172.64.41.3	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 03:03:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 03:03:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 03:03:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdabe862fcb43b8-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 03:03:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 00 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49751	162.159.61.3	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 03:03:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 03:03:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 03:03:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdabe864a631a44-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 03:03:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1e 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49752	162.159.61.3	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 03:03:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 03:03:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 03:03:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdabe865ebb1831-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 03:03:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d8 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49753	162.159.61.3	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 03:03:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 03:03:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 03:03:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdabe86bb534387-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 03:03:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d9 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49756	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:04 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-04 03:03:04 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=222156 Date: Wed, 04 Sep 2024 03:03:04 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49762	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:05 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-04 03:03:05 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=222209 Date: Wed, 04 Sep 2024 03:03:05 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-04 03:03:05 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49764	142.251.35.174	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:06 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-04 03:03:06 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 04 Sep 2024 03:03:06 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49763	142.251.35.174	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:06 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-04 03:03:06 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 04 Sep 2024 03:03:06 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49765	142.250.72.100	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:06 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-04 03:03:06 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 04 Sep 2024 02:39:20 GMT Expires: Thu, 12 Sep 2024 02:39:20 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 1426 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-04 03:03:06 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-04 03:03:06 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-04 03:03:06 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-04 03:03:06 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-04 03:03:06 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49774	13.107.246.60	443	8124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:12 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 03:03:12 UTC	531	IN	HTTP/1.1 200 OK Date: Wed, 04 Sep 2024 03:03:12 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 30 Aug 2024 17:05:10 GMT ETag: 0x8DCC915E7CD8385 x-ms-request-id: 1b6aa40f-801e-0039-70c1-fc28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240904T030312Z-16579567576p25xcxh3nycmsaw0000000a1g000000003gp0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-04 03:03:12 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49775	142.250.181.225	443	8124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:12 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 03:03:12 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8ljvFkAfGD6T3x8T4YFrQfJobCyIDZeeGVWY9_EIjqMb4CRuA1Od_ViYDskpUy0UL2dPhkS4 X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Tue, 03 Sep 2024 19:26:09 GMT Expires: Wed, 03 Sep 2025 19:26:09 GMT Cache-Control: public, max-age=31536000 Age: 27423 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-04 03:03:12 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-09-04 03:03:12 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-09-04 03:03:12 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-09-04 03:03:12 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-09-04 03:03:12 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-09-04 03:03:12 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-09-04 03:03:12 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-09-04 03:03:12 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-09-04 03:03:12 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-09-04 03:03:12 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49777	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NgDdrNz7WkUwVMy&MD=NAEAxaNk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-04 03:03:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b8138c1d-14a3-4dca-800c-b8516c854ea2 MS-RequestId: d95e9684-f37d-4a99-a3eb-b172122b935c MS-CV: kzb6e2eCLU6gECXj.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 04 Sep 2024 03:03:13 GMT Connection: close Content-Length: 24490
2024-09-04 03:03:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-04 03:03:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49782	162.159.61.3	443	8124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:15 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 03:03:15 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 03:03:15 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 03:03:15 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdabed39fde42aa-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 03:03:15 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49783	162.159.61.3	443	8124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:15 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 03:03:15 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 03:03:15 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 03:03:15 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdabed3b95f43a7-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 03:03:15 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 95 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49784	172.64.41.3	443	8124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:15 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 03:03:15 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 03:03:15 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 03:03:15 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdabed3ed334211-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 03:03:15 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49789	23.200.0.42	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:29 UTC	382	OUT	POST /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Content-Length: 470 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 03:03:29 UTC	470	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 37 30 35 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 31 30 37 2e 36 2e 31 35 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 75 73 69 6e 65 73 73 2e 62 69 6e 67 2e 63 6f 6d Data Ascii: [{"age":5,"body":{"elapsed_time":705,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"13.107.6.158","status_code":401,"type":"http.error"},"type":"network-error","url":"https://business.bing.com
2024-09-04 03:03:30 UTC	378	IN	HTTP/1.1 503 Service Unavailable Content-Length: 326 Content-Type: text/html; charset=us-ascii Date: Wed, 04 Sep 2024 03:03:29 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.2aac2d17.1725419009.9cf0e41 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-09-04 03:03:30 UTC	326	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49792	152.195.19.97	443	8124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:31 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726023792&P2=404&P3=2&P4=QEgMGZbL3Pd%2bfrib5J8QmPE3IgrGPOf1mROENn0UQDviE01AkgpDuSO7Xs%2f%2bTYts5mnwRHQfEVIzX0nnjovayw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: PLv1kfp2Cqs/R4Pe8oDocQ Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 03:03:31 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5345542 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 04 Sep 2024 03:03:31 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-09-04 03:03:31 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49797	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:03:52 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=NgDdrNz7WkUwVMy&MD=NAEAxaNk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-04 03:03:52 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 03adb418-d12b-4d0c-8c92-1f2afdff5d57 MS-RequestId: 9842d8a2-7d00-4cca-a6bc-11280fbec80d MS-CV: 88lexjoqxUSEkIOO.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 04 Sep 2024 03:03:52 GMT Connection: close Content-Length: 30005
2024-09-04 03:03:52 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-04 03:03:52 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49802	23.219.161.132	443	7872	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 03:05:00 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8

Target ID:	0
Start time:	23:02:54
Start date:	03/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5e0000
File size:	917'504 bytes
MD5 hash:	437238E0E1120FA6FF1F6D4B4C1F4DD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	23:02:54
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:02:54
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=2076,i,6179956971381571465,2562617377228832448,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:02:54
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	23:02:55
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2680 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	23:02:59
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3316 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:02:59
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6940 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:02:59
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6716 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff7ff3d0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:03:00
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6716 --field-trial-handle=2628,i,8053104079492519659,8142298767630969302,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff7ff3d0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:03:08
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	23:03:08
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3224 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	23:03:08
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3848 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:03:10
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6032 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:8
Imagebase:	0x7ff7ff3d0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:03:10
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6032 --field-trial-handle=2312,i,4612547992709842406,11706318082803101733,262144 /prefetch:8
Imagebase:	0x7ff7ff3d0000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:03:16
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:03:16
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2072,i,18002439512666403320,14090865055409396734,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:03:24
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:03:24
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1996,i,7786681710576606100,13039265297249952861,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:03:37
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:03:38
Start date:	03/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1972 --field-trial-handle=2068,i,11270960344324331106,14206124446071380624,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5%
Total number of Nodes:	1367
Total number of Limit Nodes:	43

Executed Functions

Function 005FF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 005FF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0063F474
IsIconic.USER32(00000000), ref: 0063F47D
ShowWindow.USER32(00000000,00000009), ref: 0063F48A
SetForegroundWindow.USER32(00000000), ref: 0063F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0063F4AA
GetCurrentThreadId.KERNEL32 ref: 0063F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0063F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0063F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0063F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0063F4DE
SetForegroundWindow.USER32(00000000), ref: 0063F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0063F4F6
keybd_event.USER32(00000012,00000000), ref: 0063F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0063F50B
keybd_event.USER32(00000012,00000000), ref: 0063F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0063F519
keybd_event.USER32(00000012,00000000), ref: 0063F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0063F528
keybd_event.USER32(00000012,00000000), ref: 0063F52D
SetForegroundWindow.USER32(00000000), ref: 0063F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0063F557

Strings

Shell_TrayWnd, xrefs: 0063F46F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 58cdf190b999a9899c63b6bed77f64114ce83b86bb5bc3a5aeb22220beaa77c3
Instruction ID: c49ba8be927df1b791c8c5670acaa25448c47fd8c4ae127402db0e42de0232b7
Opcode Fuzzy Hash: 58cdf190b999a9899c63b6bed77f64114ce83b86bb5bc3a5aeb22220beaa77c3
Instruction Fuzzy Hash: 5A317471E40218BBFB246BB55C4AFBF7E6EEB44B60F101029F604EA1D1C6B15D50ABA0

Function 005E42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 005E430D

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

GetCurrentProcess.KERNEL32(?,0067CB64,00000000,?,?), ref: 005E4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 005E4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 005E4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 005E4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 005E4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 005E447B
GetSystemInfo.KERNEL32(?,?,?), ref: 005E44A0

Strings

|O, xrefs: 006236F8
GetNativeSystemInfo, xrefs: 005E4460
kernel32.dll, xrefs: 005E444F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 24937ed19702f929b80a7f563b3026ecc23dcc6fd55559186e9931d6c0edfa82
Instruction ID: 5cb65155926873ff61b3fc0082a406ae2abecca53917b86f6bb85c08fadbd97b
Opcode Fuzzy Hash: 24937ed19702f929b80a7f563b3026ecc23dcc6fd55559186e9931d6c0edfa82
Instruction Fuzzy Hash: 77A1A3E191A7E0EFCB15C76978601D97FE77B27300B986AA9D0819BB61F32445C4CF21

Function 005E42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,005E50AA,?,?,00000000,00000000), ref: 005E42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,005E50AA,?,?,00000000,00000000), ref: 005E42C9
LoadResource.KERNEL32(?,00000000,?,?,005E50AA,?,?,00000000,00000000,?,?,?,?,?,?,005E4F20), ref: 006235BE
SizeofResource.KERNEL32(?,00000000,?,?,005E50AA,?,?,00000000,00000000,?,?,?,?,?,?,005E4F20), ref: 006235D3
LockResource.KERNEL32(005E50AA,?,?,005E50AA,?,?,00000000,00000000,?,?,?,?,?,?,005E4F20,?), ref: 006235E6

Strings

SCRIPT, xrefs: 005E42BF

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: a08f016af2b7190d65674aa82800f431a7f28903de88e9d55b7e23b99919a7e0
Instruction ID: 4fae39fee2a30c21df7936778e3de57568f3e70623a59005b6ac67affc923c64
Opcode Fuzzy Hash: a08f016af2b7190d65674aa82800f431a7f28903de88e9d55b7e23b99919a7e0
Instruction Fuzzy Hash: 6111ACB4200700BFD7298B66DC48F277BBAEBC5B61F10816DB51696260DB71D8008A20

Function 00622BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 005E2B6B

Part of subcall function 005E3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,006B1418,?,005E2E7F,?,?,?,00000000), ref: 005E3A78

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,006A2224), ref: 00622C10
ShellExecuteW.SHELL32(00000000,?,?,006A2224), ref: 00622C17

Strings

runas, xrefs: 00622C0B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 64d42ab3138d7f23e6133d03c9fbf288d7261f446d49037cfac77b54aa42a4b8
Instruction ID: ff8f676dad41bb193fdae41299614d6eff7bbd1889c3a3e98b27ff4cf964722b
Opcode Fuzzy Hash: 64d42ab3138d7f23e6133d03c9fbf288d7261f446d49037cfac77b54aa42a4b8
Instruction Fuzzy Hash: D211A5711083C26AC71CFF61D86D9AE7FAABBD5351F54182DF0C6170A2DF218A8AC712

Function 0064DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00625222), ref: 0064DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0064DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0064DBEE
FindClose.KERNEL32(00000000), ref: 0064DBFA

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: c33e0491d015a1ef8a099f5efe8b438a88fc5105cae18381fd69bf16864c57b7
Instruction ID: 3f80ad721fc47e1f8939c957b280bebc3ae53d70b36cfe42cf02d0759bf5b623
Opcode Fuzzy Hash: c33e0491d015a1ef8a099f5efe8b438a88fc5105cae18381fd69bf16864c57b7
Instruction Fuzzy Hash: 05F0A07082091057C3256BB8AC4D8AA376E9F03374B50471AF83AC22E0EBB05AD58695

Function 0066AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0066B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0066B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0066B1D4
_wcslen.LIBCMT ref: 0066B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0066B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0066B236
_wcslen.LIBCMT ref: 0066B332

Part of subcall function 006505A7: GetStdHandle.KERNEL32(000000F6), ref: 006505C6

_wcslen.LIBCMT ref: 0066B34B
_wcslen.LIBCMT ref: 0066B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0066B3B6
GetLastError.KERNEL32(00000000), ref: 0066B407
CloseHandle.KERNEL32(?), ref: 0066B439
CloseHandle.KERNEL32(00000000), ref: 0066B44A
CloseHandle.KERNEL32(00000000), ref: 0066B45C
CloseHandle.KERNEL32(00000000), ref: 0066B46E
CloseHandle.KERNEL32(?), ref: 0066B4E3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: fa211afaf05cfd239ef1bad8858328f95f79caa94ea49dc311d1188ea15a51dd
Instruction ID: 76252e02798d5559c7b3e9d5a110c8e70a259d5d8417ed24954e70a00d0602fa
Opcode Fuzzy Hash: fa211afaf05cfd239ef1bad8858328f95f79caa94ea49dc311d1188ea15a51dd
Instruction Fuzzy Hash: 67F19931604341DFC718EF24C895A6ABBE6BF85310F14845DF9899B3A2DB30EC85CB52

Function 005ED730 Relevance: 21.6, APIs: 14, Instructions: 627windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 005ED807
timeGetTime.WINMM ref: 005EDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005EDB28
TranslateMessage.USER32(?), ref: 005EDB7B
DispatchMessageW.USER32(?), ref: 005EDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005EDB9F
Sleep.KERNELBASE(0000000A), ref: 005EDBB1

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: a66dbdb2a51d546fe089bd0d06a22089ed7c44cad03eac81f6ce316414ea9897
Instruction ID: dfcbb30ff3aec0cefdd5a18990b6121bf6e56b0b0a8b00f821e5d8e8b11d7958
Opcode Fuzzy Hash: a66dbdb2a51d546fe089bd0d06a22089ed7c44cad03eac81f6ce316414ea9897
Instruction Fuzzy Hash: 5542F570608382DFD728CF25C854BAABBF6BF86314F14465DE4958B391D774E884CBA2

Function 005E2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 005E2D07
RegisterClassExW.USER32(00000030), ref: 005E2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005E2D42
InitCommonControlsEx.COMCTL32(?), ref: 005E2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 005E2D6F
LoadIconW.USER32(000000A9), ref: 005E2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 005E2D94

Strings

0, xrefs: 005E2CE9
AutoIt v3 GUI, xrefs: 005E2D23
TaskbarCreated, xrefs: 005E2D37
+, xrefs: 005E2CF0

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 5d4f8aaa4bbcefa0ea72c0653c6a142bf2a608265eb5239e3e126b666961f037
Instruction ID: 2ddf810a02e05a95464e5a8823613737103723aaa3ff8c05382e06aa072612d6
Opcode Fuzzy Hash: 5d4f8aaa4bbcefa0ea72c0653c6a142bf2a608265eb5239e3e126b666961f037
Instruction Fuzzy Hash: F32113B0901348AFDB04EFA4EC59BDDBBB6FB08711F10921AF615AA2A0D7B10580CF90

Function 0062065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0062039A: CreateFileW.KERNELBASE(00000000,00000000,?,00620704,?,?,00000000,?,00620704,00000000,0000000C), ref: 006203B7

GetLastError.KERNEL32 ref: 0062076F
__dosmaperr.LIBCMT ref: 00620776
GetFileType.KERNELBASE(00000000), ref: 00620782
GetLastError.KERNEL32 ref: 0062078C
__dosmaperr.LIBCMT ref: 00620795
CloseHandle.KERNEL32(00000000), ref: 006207B5
CloseHandle.KERNEL32(?), ref: 006208FF
GetLastError.KERNEL32 ref: 00620931
__dosmaperr.LIBCMT ref: 00620938

Strings

H, xrefs: 006208BD

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: ba2c689ff9175cad362a6d30b8b428c48adeb812ebbb57f2a28ddb653bd3205b
Instruction ID: 89686cc03d466ad5e4d336636d93e473e26f60959343877b3629fb06bab6c228
Opcode Fuzzy Hash: ba2c689ff9175cad362a6d30b8b428c48adeb812ebbb57f2a28ddb653bd3205b
Instruction Fuzzy Hash: B9A12432A105188FEF19EF68E851BAE7BA2AB06320F14415DF8159F3D2D7319953CF91

Function 005E344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005E3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,006B1418,?,005E2E7F,?,?,?,00000000), ref: 005E3A78

Part of subcall function 005E3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 005E3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 005E356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0062318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 006231CE
RegCloseKey.ADVAPI32(?), ref: 00623210
_wcslen.LIBCMT ref: 00623277
_wcslen.LIBCMT ref: 00623286

Strings

Include, xrefs: 00623184, 006231C5
\, xrefs: 0062328C
Software\AutoIt v3\AutoIt, xrefs: 005E3560
\Include\, xrefs: 005E3527

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 016f8999bcea15b3e888113c725f55ff8c408d0dc7d54ad3bb2956ee8ca7cbab
Instruction ID: b582f6b8cca7c8b7421e4c42e30fb75f3a50ac6c7d5977c7d87e6e878585f892
Opcode Fuzzy Hash: 016f8999bcea15b3e888113c725f55ff8c408d0dc7d54ad3bb2956ee8ca7cbab
Instruction Fuzzy Hash: 7B71D7B14043529FC318EF25EC958ABBBEAFF85740F40592DF58587261EB349A88CB51

Function 005E2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 005E2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 005E2B9D
LoadIconW.USER32(00000063), ref: 005E2BB3
LoadIconW.USER32(000000A4), ref: 005E2BC5
LoadIconW.USER32(000000A2), ref: 005E2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 005E2BEF
RegisterClassExW.USER32(?), ref: 005E2C40

Part of subcall function 005E2CD4: GetSysColorBrush.USER32(0000000F), ref: 005E2D07
Part of subcall function 005E2CD4: RegisterClassExW.USER32(00000030), ref: 005E2D31
Part of subcall function 005E2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005E2D42
Part of subcall function 005E2CD4: InitCommonControlsEx.COMCTL32(?), ref: 005E2D5F
Part of subcall function 005E2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 005E2D6F
Part of subcall function 005E2CD4: LoadIconW.USER32(000000A9), ref: 005E2D85
Part of subcall function 005E2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 005E2D94

Strings

#, xrefs: 005E2C16
0, xrefs: 005E2C0F
AutoIt v3, xrefs: 005E2C2F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 7065a70de7adb5177d020c06abc64803e54d1c456807c1a1c1b2071c21ce7c13
Instruction ID: ed5745a3a8ad1110119e7960bd0c714138fb2a2c02d4f16afc98e9ae20a07852
Opcode Fuzzy Hash: 7065a70de7adb5177d020c06abc64803e54d1c456807c1a1c1b2071c21ce7c13
Instruction Fuzzy Hash: 91217FB1E10314BBDB149FA5EC65A9D7FF6FB49B50F50111AE604AA2A0E7B10A80CF90

Function 005EB710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005EBB4E

Strings

p#k, xrefs: 00630263
x#k, xrefs: 00630207
p#k, xrefs: 0063024F
p#k, xrefs: 005EBA72
p%k, xrefs: 005EB8DC
x#k, xrefs: 00630168
p#k, xrefs: 005EBB6B
p%k, xrefs: 005EBB32

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: p#k$p#k$p#k$p#k$p%k$p%k$x#k$x#k
API String ID: 1385522511-4111703476
Opcode ID: f49593c89472c8d574a7162f2b52ce3100b89972b13b1d8c7038e6d15236c81b
Instruction ID: 30a7a589868795d68c0615d4944458b851d8023fb4abde4434eed633352baed3
Opcode Fuzzy Hash: f49593c89472c8d574a7162f2b52ce3100b89972b13b1d8c7038e6d15236c81b
Instruction Fuzzy Hash: E332C071A0024ADFEB18CF55C8A4ABABBFAFF44301F148059E985AB351C774AD85CB91

Function 005E3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,005E316A,?,?), ref: 005E31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,005E316A,?,?), ref: 005E3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 005E3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,005E316A,?,?), ref: 005E3232
CreatePopupMenu.USER32 ref: 005E3246
PostQuitMessage.USER32(00000000), ref: 005E3267

Strings

TaskbarCreated, xrefs: 005E322D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: c2fac2a5b0ba780c7924cb2a3f7e3475cec8bd3c15f386d41857c72dc6cb512e
Instruction ID: 8b475ed404ae095d7c1e7917e2905e8c1f6ce6ddec0687713bcade4531b12ad4
Opcode Fuzzy Hash: c2fac2a5b0ba780c7924cb2a3f7e3475cec8bd3c15f386d41857c72dc6cb512e
Instruction Fuzzy Hash: DD4126B5204285BBDB1C1B29DC3DBB93E57FB42350F44152DF6C58B2A1DA618A80D761

Function 005E2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 005E2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 005E2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,005E1CAD,?), ref: 005E2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,005E1CAD,?), ref: 005E2CCF

Strings

AutoIt v3, xrefs: 005E2C89, 005E2C8E, 005E2C8F
edit, xrefs: 005E2CAC

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 725caae75e5da0114089c33fecf1760b92bd63bc0a5bce52aa52037e600ffe65
Instruction ID: 2959680de7cd0992e60be546ad5e147a4448514aa7e703f8782b3841e84e709e
Opcode Fuzzy Hash: 725caae75e5da0114089c33fecf1760b92bd63bc0a5bce52aa52037e600ffe65
Instruction Fuzzy Hash: 9CF030B55402907BE73007236C18E772EBFD7C7F60B54511DFA04D61A0D6610880DB70

Function 00612DF8 Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,0060F2DE,00613863,006B1444,?,005FFDF5,?,?,005EA976,00000010,006B1440,005E13FC,?,005E13C6), ref: 00612DFD
_free.LIBCMT ref: 00612E32
_free.LIBCMT ref: 00612E59
SetLastError.KERNEL32(00000000,005E1129), ref: 00612E66
SetLastError.KERNEL32(00000000,005E1129), ref: 00612E6F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: cc3fecb5b305cbe6132a38d512cf9a85533b01d936c8c86c15af5b4458ac1873
Instruction ID: 6a430c22b543959f164affc86518db3a1df96e6debe746aa3346ceaf0ee53c15
Opcode Fuzzy Hash: cc3fecb5b305cbe6132a38d512cf9a85533b01d936c8c86c15af5b4458ac1873
Instruction Fuzzy Hash: 38012D3224560267C71277396C95DEB155FAFD1775B2D042CF419E23D2EF308CE14120

Function 0064E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0064E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0064E9A5
Sleep.KERNEL32(00000000), ref: 0064E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0064E9B7
Sleep.KERNELBASE ref: 0064E9F3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 11dbdbd64a7c606c2c6050ec86845013487e7d26020a2057fb6ed9f0ad91b8fb
Instruction ID: d356280e786c969adce460feb5632b4cc9f0117bdab96b8232d4875f6fd90acc
Opcode Fuzzy Hash: 11dbdbd64a7c606c2c6050ec86845013487e7d26020a2057fb6ed9f0ad91b8fb
Instruction Fuzzy Hash: 6B018C31C0162DDBCF04AFE4DC59AEDBB7AFF09320F40055AE502B2281CB359691CBA1

Function 005E3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,005E3B0F,SwapMouseButtons,00000004,?), ref: 005E3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,005E3B0F,SwapMouseButtons,00000004,?), ref: 005E3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,005E3B0F,SwapMouseButtons,00000004,?), ref: 005E3B83

Strings

Control Panel\Mouse, xrefs: 005E3B3E

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: afd7c1ae819ac8f79f8cf12459a95b33585bfdbcf154a367df9374eff396d959
Instruction ID: 564ac1109c731db291cbce420af13b0e000834e0b3d92ba583ad6034ba2da02d
Opcode Fuzzy Hash: afd7c1ae819ac8f79f8cf12459a95b33585bfdbcf154a367df9374eff396d959
Instruction Fuzzy Hash: 0E112AB5510248FFDB24CFA6DC48AAEBBBCFF44754B104959E846D7110E2319E4097A0

Function 005E3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 006233A2

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 005E3A04

Strings

Line: , xrefs: 006233EB

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 8a0ec7f933907d9d5b454ccf5af261adf7b5f1366b91532efebb7dcc0b7d6098
Instruction ID: 56d2bdfeaa53707518870b674bab0b25ce447e1b24052eef88f25415e4544edd
Opcode Fuzzy Hash: 8a0ec7f933907d9d5b454ccf5af261adf7b5f1366b91532efebb7dcc0b7d6098
Instruction Fuzzy Hash: 8531E6B1408395AAC328EB11DC49BDB7BD9BF85750F10492EF5D983191EB749684C7C2

Function 005E2DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00622C8C

Part of subcall function 005E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005E3A97,?,?,005E2E7F,?,?,?,00000000), ref: 005E3AC2

Part of subcall function 005E2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005E2DC4

Strings

X, xrefs: 00622C5A
`ej, xrefs: 00622C85

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`ej
API String ID: 779396738-472619002
Opcode ID: fde6b00084f32d85f41655beb9acce1642eca91ca73cdce5e88672396169d726
Instruction ID: a6983def089c66f4fd9a497a65d2825f07a6b194cfc6ef5993c4201fbccb1124
Opcode Fuzzy Hash: fde6b00084f32d85f41655beb9acce1642eca91ca73cdce5e88672396169d726
Instruction Fuzzy Hash: C621D870E00298AFCB45EF95C809BEE7FFDAF49304F048059F445A7241DBB459898F61

Function 005FFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00600668

Part of subcall function 006032A4: RaiseException.KERNEL32(?,?,?,0060068A,?,006B1444,?,?,?,?,?,?,0060068A,005E1129,006A8738,005E1129), ref: 00603304

__CxxThrowException@8.LIBVCRUNTIME ref: 00600685

Strings

Unknown exception, xrefs: 00600692

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: e2a54ed1939314aa490cc948ed513ab4d77c680ecf9d6d29d220515796e40a5b
Instruction ID: 54cf10a150794c2847500b582084eecdabb1898b2bc960525a49a56adb0d1517
Opcode Fuzzy Hash: e2a54ed1939314aa490cc948ed513ab4d77c680ecf9d6d29d220515796e40a5b
Instruction Fuzzy Hash: 7CF0FC3494020D77DB08B664DC46D9F7B6FAE00350F604535B914D6AD1EF72DB25CAC4

Function 005E10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 005E1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 005E1BF4
Part of subcall function 005E1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 005E1BFC
Part of subcall function 005E1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 005E1C07
Part of subcall function 005E1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 005E1C12
Part of subcall function 005E1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 005E1C1A
Part of subcall function 005E1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 005E1C22

Part of subcall function 005E1B4A: RegisterWindowMessageW.USER32(00000004,?,005E12C4), ref: 005E1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 005E136A
OleInitialize.OLE32 ref: 005E1388
CloseHandle.KERNEL32(00000000,00000000), ref: 006224AB

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: e1bae4a6e23a2caf142812b2112235de3a3a5252b20946ac497c39298b3b9438
Instruction ID: 3fe766140fd046d3fc388d398f11792b3a0219c5934142e317184d0ad19d8ad6
Opcode Fuzzy Hash: e1bae4a6e23a2caf142812b2112235de3a3a5252b20946ac497c39298b3b9438
Instruction Fuzzy Hash: 8171D2F6911241AEC3A4DF7AA8796953FE3BB8A350794A32ED05ACF261E73044C18F54

Function 0064C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 005E3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0064C259
KillTimer.USER32(?,00000001,?,?), ref: 0064C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0064C270

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 686ce9d4a22f9d55f40a32f3c141bfe00b277efea8e3d63b6662bf5cde946146
Instruction ID: eb29a959622261c18cf92cb26f3b8c956a06aa0ae564bd2f65ca2d0538e05040
Opcode Fuzzy Hash: 686ce9d4a22f9d55f40a32f3c141bfe00b277efea8e3d63b6662bf5cde946146
Instruction Fuzzy Hash: 9131E370905344AFEB629F648859BE7BBEEAF02318F00009ED2DEA7341C7B45B85CB51

Function 006186AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,006185CC,?,006A8CC8,0000000C), ref: 00618704
GetLastError.KERNEL32(?,006185CC,?,006A8CC8,0000000C), ref: 0061870E
__dosmaperr.LIBCMT ref: 00618739

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 0dababb6551989c7f8c0458817ab87980875e43277f06d7dba808af3b42cb1fd
Instruction ID: 4be0ef869f520d3e2ac49807e6c8ed9f571ec024c40ba51cef4749b92a7d6781
Opcode Fuzzy Hash: 0dababb6551989c7f8c0458817ab87980875e43277f06d7dba808af3b42cb1fd
Instruction Fuzzy Hash: B701DB326056605ED6A4A33468457FE6B5B4BD1774F3D021EF8199B2D3EFA18CC181D4

Function 005EDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 005EDB7B
DispatchMessageW.USER32(?), ref: 005EDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005EDB9F
Sleep.KERNELBASE(0000000A), ref: 005EDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00631CC9

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 8f16491d6b958952b15f7cd6910869dc8bbf076580702b4da5a089f074ddcfa9
Instruction ID: ab30279e8b293d41ca30ae045ef027eb192475427c888c623b8d2a313771bb90
Opcode Fuzzy Hash: 8f16491d6b958952b15f7cd6910869dc8bbf076580702b4da5a089f074ddcfa9
Instruction Fuzzy Hash: 98F05E306443809BE738CB61DC99FEA77BEFB85310F505A19E64AC70D0EB3494888B25

Function 005F1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005F17F6

Strings

CALL, xrefs: 005F17C6

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 103b8f53b5c3ad8f3fcc104e06c6df83f6dedc7985b3234fda2f81e8704600b8
Instruction ID: db9d6a6b26b49c250e08272f4467a8e73b68af78f2b3fd9731e3b6999f628160
Opcode Fuzzy Hash: 103b8f53b5c3ad8f3fcc104e06c6df83f6dedc7985b3234fda2f81e8704600b8
Instruction Fuzzy Hash: F0229B70608606DFC714DF14C484A3ABBF2BF85354F14892DF69A8B3A2D739E845CB96

Function 005E3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 005E3908

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: adb3e5c429e266fffc0beef562595b67847ae363a69aa3de503c7a17d3ec4d39
Instruction ID: 0e42f9973f715a7c372e04c85ca7382a4ee4c891c55c8b08e9153165ffcfb94d
Opcode Fuzzy Hash: adb3e5c429e266fffc0beef562595b67847ae363a69aa3de503c7a17d3ec4d39
Instruction Fuzzy Hash: E331BFB16097419FD360DF25D8987A7BBE8FB49308F00092EF6D987240E771AA44CB52

Function 005FF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 005FF661

Part of subcall function 005ED730: GetInputState.USER32 ref: 005ED807

Sleep.KERNEL32(00000000), ref: 0063F2DE

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: dd4ef764ca450d9a0444d8001e1dcc7692b4020f6896b1f40e0b0a0ee590e8a1
Instruction ID: 705b527f9974dc7f8ba65edc4f6e0063a232883ab165c98f16ca8374378e965f
Opcode Fuzzy Hash: dd4ef764ca450d9a0444d8001e1dcc7692b4020f6896b1f40e0b0a0ee590e8a1
Instruction Fuzzy Hash: 9FF012312406459FD318EF65D449B6ABBE9FF45761F00412EE95EC7361DB70A840CB91

Function 00672598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00672649

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: ecefdf8d788fa8af54fc49d42498a5033c4451cc3dd892ce8265f18a9e62a924
Instruction ID: 9f5ad17bc24244d12149863fa76798e0ef1bce0296cc46c7b370802863377b61
Opcode Fuzzy Hash: ecefdf8d788fa8af54fc49d42498a5033c4451cc3dd892ce8265f18a9e62a924
Instruction Fuzzy Hash: E821C574200216AFE754DF15C8E0976BB9AFF45368B24C05DE8AA8B392C771ED41CB90

Function 006713B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00671420

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: e87ece0e66a1b5b409a45d20dd64f083902af2f02b04c11ac0eb45dd425312fe
Instruction ID: d58b12ea2810f751933bd3431e65aef6629d8c61e07b3c82536a8eb8f11af4bb
Opcode Fuzzy Hash: e87ece0e66a1b5b409a45d20dd64f083902af2f02b04c11ac0eb45dd425312fe
Instruction Fuzzy Hash: 0B317E30604243AFD754EF29C495B69BBA2FF85324F148169E8694F396DB71EC41CBD0

Function 005E4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 005E4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,005E4EDD,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4E9C
Part of subcall function 005E4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 005E4EAE
Part of subcall function 005E4E90: FreeLibrary.KERNEL32(00000000,?,?,005E4EDD,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4EFD

Part of subcall function 005E4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00623CDE,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4E62
Part of subcall function 005E4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 005E4E74
Part of subcall function 005E4E59: FreeLibrary.KERNEL32(00000000,?,?,00623CDE,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4E87

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 13fdde27fd08b2dfe0e001c312e2f55e7b79df610c65b499f138f20f4149cc0c
Instruction ID: d8bdde53c9fceda65e45da4d2f33dca356e3f97632ad6a34e519dc54da9da39e
Opcode Fuzzy Hash: 13fdde27fd08b2dfe0e001c312e2f55e7b79df610c65b499f138f20f4149cc0c
Instruction Fuzzy Hash: 1D11EB31600356AACF18BB61DC06FAD7BA5BF80B10F10481DF5D2A62C1EE759A459F50

Function 00618402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00618440

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 4c02bb1b7f2a68c439d552ebc562ed705d38592714ad17f55e448ef8c97578ba
Instruction ID: be49da7b9c645418c16b3a52e161835709f9fcde34cfa8176ce716a8138a01df
Opcode Fuzzy Hash: 4c02bb1b7f2a68c439d552ebc562ed705d38592714ad17f55e448ef8c97578ba
Instruction Fuzzy Hash: F211487190410AAFCB05DF58E9419DA7BF6EF48300F144059F808AB312DA31DA11CBA4

Function 006729BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,006714B5,?), ref: 00672A01

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 5f38d293472211c443bba4fc871b02b0d926b3c4b12e0bb5b9c275dfab7e89b6
Instruction ID: 6ad43ff389ba369505f3367a851bffb0cc0c2c1f468659cfc6d559f0c15009ac
Opcode Fuzzy Hash: 5f38d293472211c443bba4fc871b02b0d926b3c4b12e0bb5b9c275dfab7e89b6
Instruction Fuzzy Hash: 33014C36740A429FD325CA2AC464B6677A3EBC5314F69C569D14B8B251DA32EC42C7A0

Function 0060E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: c8c53f5dc835dc5730c24553c5c6de0a120e7874fce84ee12a40d313f0db2c4d
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 4BF0F932560A249AD6393A69AC05BD7339B9F52335F140B1DF421932D2CF76984286AD

Function 0067149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 006714EB

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 093ec8eaea3d98db6c5895606d33d2fdcd56a3c4a2ea8fe00480956fe4ce9b5d
Instruction ID: e2878b8932957670f3fc96de9e60939a582201a7b0b552fadf95e028f68846bb
Opcode Fuzzy Hash: 093ec8eaea3d98db6c5895606d33d2fdcd56a3c4a2ea8fe00480956fe4ce9b5d
Instruction Fuzzy Hash: 3701B1352046419F9324CF6EC450826BB96FB85324754C05EE84E8F706D632DE82CB80

Function 00614C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,005E1129,00000000,?,00612E29,00000001,00000364,?,?,?,0060F2DE,00613863,006B1444,?,005FFDF5,?), ref: 00614CBE

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 89f0b335708d234fc6feb84e5673f3132cd39e498902a2ebacfacead52cc4e4d
Instruction ID: 79ddc648b51fd21d31f0c8dd84617af3d2791acdfb0f42c1288b4958affcc655
Opcode Fuzzy Hash: 89f0b335708d234fc6feb84e5673f3132cd39e498902a2ebacfacead52cc4e4d
Instruction Fuzzy Hash: 14F0E23164222467DB355F66DC09BDB378BBF917B0B1C8229BC19AB3D0CE30D88186E0

Function 00613820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,006B1444,?,005FFDF5,?,?,005EA976,00000010,006B1440,005E13FC,?,005E13C6,?,005E1129), ref: 00613852

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 65410cdbb187b61486d7ba4dc939ee4022f31bd1ac236be37b715911b3a054ff
Instruction ID: 43d1c8594d9113c3ebece6d67872b74f2c9027d66365656f24a0f65b3da44f01
Opcode Fuzzy Hash: 65410cdbb187b61486d7ba4dc939ee4022f31bd1ac236be37b715911b3a054ff
Instruction Fuzzy Hash: F2E0E531140234A6D7B127669C04BDB374BAF427B0F0D0124BD0B96BC0DB10DE8182E4

Function 005E4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4F6D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4fc56535f7d7f892b0946980fd27d16ceb537cefea7f7a72b55fb7e5cb89ef46
Instruction ID: a5c691d202a0defc3e935735f1577d476b05f89326a7d8ea070fe3b100db73b0
Opcode Fuzzy Hash: 4fc56535f7d7f892b0946980fd27d16ceb537cefea7f7a72b55fb7e5cb89ef46
Instruction Fuzzy Hash: 07F01C71105791CFDB3C9F66D494812BBE5BF147293108D7EE1EA82611C7369C44DF50

Function 00672A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00672A66

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: f5b3efadca80730e50e9a42dc01aeec55948e8314603a553978ba6d36dee440f
Instruction ID: c90c70801675b68b58c5c148e8a59c496eca0dff01177193051820420da1586c
Opcode Fuzzy Hash: f5b3efadca80730e50e9a42dc01aeec55948e8314603a553978ba6d36dee440f
Instruction Fuzzy Hash: 5AE04F36354116AAC754EA30EC919FA735EEB50395B20953AAC1AD6200EB30999686A4

Function 005E2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005E2DC4

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 11c8aa1a70a7103445aa820f1fb3f742cc10b52864c2314aa5c644eb19cc0726
Instruction ID: 9e07ab97835a308f5f1841ddc8730618fdab2c251e7740f752bb5cca3b6b2a04
Opcode Fuzzy Hash: 11c8aa1a70a7103445aa820f1fb3f742cc10b52864c2314aa5c644eb19cc0726
Instruction Fuzzy Hash: ACE0CD726041245BC71092589C05FDA77DEEFC87D0F044075FD49D7258D960ADC08550

Function 005E2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005E3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 005E3908

Part of subcall function 005ED730: GetInputState.USER32 ref: 005ED807

SetCurrentDirectoryW.KERNEL32(?), ref: 005E2B6B

Part of subcall function 005E30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 005E314E

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 4b12323835c4ca9e990c82dfbab7f8db55c69b743fd66cef0f514644b47b685f
Instruction ID: 6de690af546a95495cccab8e0e999a7b5e712e1b0390efcff5192f51a0297e39
Opcode Fuzzy Hash: 4b12323835c4ca9e990c82dfbab7f8db55c69b743fd66cef0f514644b47b685f
Instruction Fuzzy Hash: 9BE026213042C617C70CBB32A82E5ADBF9ABBD2361F80153EF0C247162CE214A854311

Function 00643D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00643D18

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: c397cf5d18897f3efcd9bdcb5be60185dc850867c3766d495ee3ba73decb72f8
Instruction ID: 3672fb1c24540ba5999c7cdc1cc3bc65f159e32b48a93f1e210134d239b9b575
Opcode Fuzzy Hash: c397cf5d18897f3efcd9bdcb5be60185dc850867c3766d495ee3ba73decb72f8
Instruction Fuzzy Hash: 81D012E06A03087EFB0483718C0BEBB329CC316A91F004BA87A02D64C1D9A0DE080130

Function 0062039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00620704,?,?,00000000,?,00620704,00000000,0000000C), ref: 006203B7

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ebcbbce05f116064703cf6f9c530751284429a758e1044eacc765cbfd05f0a47
Instruction ID: d6da5971aeb2f1a9c2ebff30d9eee42e5980a456cf33e1d078e024319b6cf70b
Opcode Fuzzy Hash: ebcbbce05f116064703cf6f9c530751284429a758e1044eacc765cbfd05f0a47
Instruction Fuzzy Hash: 2ED06C3204010DBBDF028F84DD06EDA3BAAFB48714F114050BE1856020C732E861AB90

Function 005E1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 005E1CBC

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: f5d373ac5df0d9252f8421e96159e9554260fb181a16ad99a00c3b476b422dcc
Instruction ID: 4b9ecb0011d820b24ef80525cdeed3a07286220fe1f66eb25446bbe443afd493
Opcode Fuzzy Hash: f5d373ac5df0d9252f8421e96159e9554260fb181a16ad99a00c3b476b422dcc
Instruction Fuzzy Hash: 16C09B76280305AFF3144780BC5AF107796A348B10F445101F70D595E3D3A224B0DB50

Non-executed Functions

Function 00679576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0067961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0067965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0067969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006796C9
SendMessageW.USER32 ref: 006796F2
GetKeyState.USER32(00000011), ref: 0067978B
GetKeyState.USER32(00000009), ref: 00679798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 006797AE
GetKeyState.USER32(00000010), ref: 006797B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006797E9
SendMessageW.USER32 ref: 00679810
SendMessageW.USER32(?,00001030,?,00677E95), ref: 00679918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0067992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00679941
SetCapture.USER32(?), ref: 0067994A
ClientToScreen.USER32(?,?), ref: 006799AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 006799BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006799D6
ReleaseCapture.USER32 ref: 006799E1
GetCursorPos.USER32(?), ref: 00679A19
ScreenToClient.USER32(?,?), ref: 00679A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00679A80
SendMessageW.USER32 ref: 00679AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00679AEB
SendMessageW.USER32 ref: 00679B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00679B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00679B4A
GetCursorPos.USER32(?), ref: 00679B68
ScreenToClient.USER32(?,?), ref: 00679B75
GetParent.USER32(?), ref: 00679B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00679BFA
SendMessageW.USER32 ref: 00679C2B
ClientToScreen.USER32(?,?), ref: 00679C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00679CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00679CDE
SendMessageW.USER32 ref: 00679D01
ClientToScreen.USER32(?,?), ref: 00679D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00679D82

Part of subcall function 005F9944: GetWindowLongW.USER32(?,000000EB), ref: 005F9952

GetWindowLongW.USER32(?,000000F0), ref: 00679E05

Strings

@GUI_DRAGID, xrefs: 0067997D
p#k, xrefs: 00679990
F, xrefs: 00679D07

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#k
API String ID: 3429851547-828980573
Opcode ID: 874436823d1b6fe73d95d5d8f49cb55e38712d3eae35d475077f7204788ec367
Instruction ID: 2c5d4ca49392d51e282c64419d2d3884b1fea17db90924ba0b5e64f45b9baa39
Opcode Fuzzy Hash: 874436823d1b6fe73d95d5d8f49cb55e38712d3eae35d475077f7204788ec367
Instruction Fuzzy Hash: CE426D74204241AFE725DF24CC94AAABBE6FF49320F14861DF699872A1D731A891CF61

Function 00674873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 006748F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00674908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00674927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0067494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0067495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0067497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 006749AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 006749D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00674A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00674A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00674A7E
IsMenu.USER32(?), ref: 00674A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00674AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00674B20
GetWindowLongW.USER32(?,000000F0), ref: 00674B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00674BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00674C82
wsprintfW.USER32 ref: 00674CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00674CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00674CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00674D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00674D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00674D5A

Strings

%d/%02d/%02d, xrefs: 00674CA8

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 5f410ef5a214f06935e517d6584778f320922380a4e75865d5b06726ca71a0a1
Instruction ID: 8502b05e1940a29cd84b0c6b317cfe1dcaee537cd0c8a10bb8e71738ddc05b0e
Opcode Fuzzy Hash: 5f410ef5a214f06935e517d6584778f320922380a4e75865d5b06726ca71a0a1
Instruction Fuzzy Hash: F812A171500259ABEB258F28CC4DFAE7BFAEF85710F108129F51ADB2E1DB789941CB50

Function 00641201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 006416C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0064170D
Part of subcall function 006416C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0064173A
Part of subcall function 006416C3: GetLastError.KERNEL32 ref: 0064174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00641286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 006412A8
CloseHandle.KERNEL32(?), ref: 006412B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 006412D1
GetProcessWindowStation.USER32 ref: 006412EA
SetProcessWindowStation.USER32(00000000), ref: 006412F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00641310

Part of subcall function 006410BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006411FC), ref: 006410D4
Part of subcall function 006410BF: CloseHandle.KERNEL32(?,?,006411FC), ref: 006410E9

Strings

, xrefs: 0064125A
Zj, xrefs: 00641392
winsta0, xrefs: 006412CC
default, xrefs: 0064130B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Zj
API String ID: 22674027-1588436954
Opcode ID: a12e6189f7f28883fa36ff3007a4bc82a4308b755c98729241815819931d0c2e
Instruction ID: f2c6a26c1b7052023ad15199f0001ee6567e097f05aeb86b2dcdae8b7152c080
Opcode Fuzzy Hash: a12e6189f7f28883fa36ff3007a4bc82a4308b755c98729241815819931d0c2e
Instruction Fuzzy Hash: 3081CF71900209AFDF259FA4DC49FEE7BBAEF05710F14412DFA15BA2A0D7319984CB60

Function 00640B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006410F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00641114
Part of subcall function 006410F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 00641120
Part of subcall function 006410F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 0064112F
Part of subcall function 006410F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 00641136
Part of subcall function 006410F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0064114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00640BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00640C00
GetLengthSid.ADVAPI32(?), ref: 00640C17
GetAce.ADVAPI32(?,00000000,?), ref: 00640C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00640C6D
GetLengthSid.ADVAPI32(?), ref: 00640C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00640C8C
HeapAlloc.KERNEL32(00000000), ref: 00640C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00640CB4
CopySid.ADVAPI32(00000000), ref: 00640CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00640CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00640D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00640D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00640D45
HeapFree.KERNEL32(00000000), ref: 00640D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00640D55
HeapFree.KERNEL32(00000000), ref: 00640D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00640D65
HeapFree.KERNEL32(00000000), ref: 00640D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00640D78
HeapFree.KERNEL32(00000000), ref: 00640D7F

Part of subcall function 00641193: GetProcessHeap.KERNEL32(00000008,00640BB1,?,00000000,?,00640BB1,?), ref: 006411A1
Part of subcall function 00641193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00640BB1,?), ref: 006411A8
Part of subcall function 00641193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00640BB1,?), ref: 006411B7

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 3639690636caedc9cd4bbe6d87503bb733c578904ab308c47b569a3ff47c17d8
Instruction ID: 9222cc7a47253a124b94befda8ddd9ad14798b018d4a9a9fa293dd34de92158b
Opcode Fuzzy Hash: 3639690636caedc9cd4bbe6d87503bb733c578904ab308c47b569a3ff47c17d8
Instruction Fuzzy Hash: D071507190021AEBEF14DFE4DC44FEEBBBABF48310F044529EA15A7251D771A945CBA0

Function 0065EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0067CC08), ref: 0065EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0065EB37
GetClipboardData.USER32(0000000D), ref: 0065EB43
CloseClipboard.USER32 ref: 0065EB4F
GlobalLock.KERNEL32(00000000), ref: 0065EB87
CloseClipboard.USER32 ref: 0065EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 0065EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0065EBC9
GetClipboardData.USER32(00000001), ref: 0065EBD1
GlobalLock.KERNEL32(00000000), ref: 0065EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 0065EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0065EC38
GetClipboardData.USER32(0000000F), ref: 0065EC44
GlobalLock.KERNEL32(00000000), ref: 0065EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0065EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0065EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0065ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 0065ECF3
CountClipboardFormats.USER32 ref: 0065ED14
CloseClipboard.USER32 ref: 0065ED59

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 7aef2a459a3bf1a176777a1e879bd310d99c46f7f2fe26b14ae2f0b9545affd1
Instruction ID: 253a5e72a90eb260f3a554552c35097f4ce53b50abcab41fdf99946c5831f858
Opcode Fuzzy Hash: 7aef2a459a3bf1a176777a1e879bd310d99c46f7f2fe26b14ae2f0b9545affd1
Instruction Fuzzy Hash: FA61E5342043429FD708EF20C888F6A7BA6FF84755F14555DF89A872A2CB32DE49CB61

Function 0065698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 006569BE
FindClose.KERNEL32(00000000), ref: 00656A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00656A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00656A75

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00656AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00656ADF

Strings

%03d, xrefs: 00656DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00656B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00656B32
%02d, xrefs: 00656C00, 00656C0A, 00656C5A, 00656CAA, 00656CFA, 00656D4A
%4d, xrefs: 00656BB1

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 61524afe4dd2b90eff7aff1a3cc52584aafefd878f518daae11ec8fa3b9f3b6a
Instruction ID: 3d2b4f85732f3db8423d472ddde7ec67adb08dd882d686f80ab9f8b2845c651f
Opcode Fuzzy Hash: 61524afe4dd2b90eff7aff1a3cc52584aafefd878f518daae11ec8fa3b9f3b6a
Instruction Fuzzy Hash: 4FD16071508341AEC314EB61C885EAFBBEDBF98704F44491DF999C7291EB34DA48CB62

Function 00659642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00659663
GetFileAttributesW.KERNEL32(?), ref: 006596A1
SetFileAttributesW.KERNEL32(?,?), ref: 006596BB
FindNextFileW.KERNEL32(00000000,?), ref: 006596D3
FindClose.KERNEL32(00000000), ref: 006596DE
FindFirstFileW.KERNEL32(*.*,?), ref: 006596FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0065974A
SetCurrentDirectoryW.KERNEL32(006A6B7C), ref: 00659768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00659772
FindClose.KERNEL32(00000000), ref: 0065977F
FindClose.KERNEL32(00000000), ref: 0065978F

Strings

*.*, xrefs: 006596F5

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 2630b5890433ff8bb2c0df49d24fd269e94f35fd7c2b520d1863e710e831f3ea
Instruction ID: 4d902f0ce25b3a27e56efcb5ef7db5bee842c252b908e7161a58c35aa3d4caba
Opcode Fuzzy Hash: 2630b5890433ff8bb2c0df49d24fd269e94f35fd7c2b520d1863e710e831f3ea
Instruction Fuzzy Hash: DE31B532541619AEDF18AFB4DC49ADE77AE9F09321F14415AF819E2190DB30DE88CE24

Function 0065979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 006597BE
FindNextFileW.KERNEL32(00000000,?), ref: 00659819
FindClose.KERNEL32(00000000), ref: 00659824
FindFirstFileW.KERNEL32(*.*,?), ref: 00659840
SetCurrentDirectoryW.KERNEL32(?), ref: 00659890
SetCurrentDirectoryW.KERNEL32(006A6B7C), ref: 006598AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 006598B8
FindClose.KERNEL32(00000000), ref: 006598C5
FindClose.KERNEL32(00000000), ref: 006598D5

Part of subcall function 0064DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0064DB00

Strings

*.*, xrefs: 0065983B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: b24357d22f73a138f8d6bd4d28d6dc54e0f9c3d907c7ddcf94a456c2ed873d66
Instruction ID: 7d1cacb8f5b31d121da33970375b5b1d6dbc14b422058fb45b42acf8dcaeb8c0
Opcode Fuzzy Hash: b24357d22f73a138f8d6bd4d28d6dc54e0f9c3d907c7ddcf94a456c2ed873d66
Instruction Fuzzy Hash: 4031C131541219AEDB14AFB4EC48ADE77AE9F06331F14456AF814A22D1DB30DE898F34

Function 0066BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0066C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0066B6AE,?,?), ref: 0066C9B5
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066C9F1
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA68
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0066BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0066BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0066BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0066C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0066C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0066C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0066C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0066C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0066C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0066C382
RegCloseKey.ADVAPI32(00000000), ref: 0066C38F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 4025d61dbff2f1f41ffeee0b1766d135782719575d371f013d98c9ed9cf6a7b1
Instruction ID: 779e9065598571d44ff4e82398343267ec3a9f8ab300ef17a79341e939444952
Opcode Fuzzy Hash: 4025d61dbff2f1f41ffeee0b1766d135782719575d371f013d98c9ed9cf6a7b1
Instruction Fuzzy Hash: 53025D706046419FC714CF24C895E2ABBE5BF89314F18849DF88ADB3A2D731ED46CB91

Function 00658195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00658257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00658267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00658273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00658310
SetCurrentDirectoryW.KERNEL32(?), ref: 00658324
SetCurrentDirectoryW.KERNEL32(?), ref: 00658356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0065838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00658395

Strings

*.*, xrefs: 0065839B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 106ae4c2e2620c5427259dc5974428693d94eb7db133721eb31617374b2b84e1
Instruction ID: e61195a678700996ace16fef09a4090857f54d7eda8bfa040ff131e331f15a1d
Opcode Fuzzy Hash: 106ae4c2e2620c5427259dc5974428693d94eb7db133721eb31617374b2b84e1
Instruction Fuzzy Hash: C46189725043459FCB14EF60C8449AFB7EAFF89311F04881EF99997251EB31EA49CB92

Function 0064D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005E3A97,?,?,005E2E7F,?,?,?,00000000), ref: 005E3AC2

Part of subcall function 0064E199: GetFileAttributesW.KERNEL32(?,0064CF95), ref: 0064E19A

FindFirstFileW.KERNEL32(?,?), ref: 0064D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0064D1DD
MoveFileW.KERNEL32(?,?), ref: 0064D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0064D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0064D237

Part of subcall function 0064D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0064D21C,?,?), ref: 0064D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0064D253
FindClose.KERNEL32(00000000), ref: 0064D264

Strings

\*.*, xrefs: 0064D0CD, 0064D0D6, 0064D0EB

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: d81d7e9e99233db45aee69df60f8d0aa6c06fa08fbcae745e616148281297eed
Instruction ID: d01d865eed7c769c762d0e96e558d31ff7c0c789984ea8e0aa4f73483ec94b2e
Opcode Fuzzy Hash: d81d7e9e99233db45aee69df60f8d0aa6c06fa08fbcae745e616148281297eed
Instruction Fuzzy Hash: E1618E31C0514E9BCF19EBE1C9969EEBBB6BF95300F204069E445771A2EB316F49CB60

Function 0065ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0065ED91
EmptyClipboard.USER32 ref: 0065ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0065EDAC
CloseClipboard.USER32 ref: 0065EEA3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: b8e397a952cb339b28119c8bf4efb03352d7dbea200631202dc286f4b496b9a8
Instruction ID: 018c0c958585259f46a927d14bfba391d680b52a8d1eeabba23fd15130e409f1
Opcode Fuzzy Hash: b8e397a952cb339b28119c8bf4efb03352d7dbea200631202dc286f4b496b9a8
Instruction Fuzzy Hash: 9241E330204611AFDB18CF15D889B59BBE2FF44329F14C09DE8298B762C736ED82CB80

Function 0064E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 006416C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0064170D
Part of subcall function 006416C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0064173A
Part of subcall function 006416C3: GetLastError.KERNEL32 ref: 0064174A

ExitWindowsEx.USER32(?,00000000), ref: 0064E932

Strings

, xrefs: 0064E95C
@, xrefs: 0064E925
, xrefs: 0064E920
SeShutdownPrivilege, xrefs: 0064E902

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 14b14430fa06db3c5a7af5c63d3b2a79b89379c11679b6f10431cdf0d3aecb15
Instruction ID: 16e1595898303a5bcd04bb3217e408b5b9adc66ef3e59c7ee0e8fea7da7fde74
Opcode Fuzzy Hash: 14b14430fa06db3c5a7af5c63d3b2a79b89379c11679b6f10431cdf0d3aecb15
Instruction Fuzzy Hash: 7B01F973610211AFEB6466B49C86FFF729EB714751F151825FD13E22D2D6A25C8082E4

Function 00661204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00661276
WSAGetLastError.WSOCK32 ref: 00661283
bind.WSOCK32(00000000,?,00000010), ref: 006612BA
WSAGetLastError.WSOCK32 ref: 006612C5
closesocket.WSOCK32(00000000), ref: 006612F4
listen.WSOCK32(00000000,00000005), ref: 00661303
WSAGetLastError.WSOCK32 ref: 0066130D
closesocket.WSOCK32(00000000), ref: 0066133C

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: bef2eea29aaba7057b71d62d0b2a7ce52897ef1fed11c129ddcb82c32b691b40
Instruction ID: 4df2497bea3f833e151461c9e8f8b4405cdcb7a04a845948ce44bb201d30e355
Opcode Fuzzy Hash: bef2eea29aaba7057b71d62d0b2a7ce52897ef1fed11c129ddcb82c32b691b40
Instruction Fuzzy Hash: 27416F31A001419FD714DF64C498B6ABBE6BF86328F1C819CD8569F396C771ED82CBA1

Function 0064D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005E3A97,?,?,005E2E7F,?,?,?,00000000), ref: 005E3AC2

Part of subcall function 0064E199: GetFileAttributesW.KERNEL32(?,0064CF95), ref: 0064E19A

FindFirstFileW.KERNEL32(?,?), ref: 0064D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0064D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0064D481
FindClose.KERNEL32(00000000), ref: 0064D498
FindClose.KERNEL32(00000000), ref: 0064D4A1

Strings

\*.*, xrefs: 0064D3F2

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 4d635e2390e09632c5a2c52a5ebdb9811b2924b89c763eaaebffbf58bfdbeb67
Instruction ID: 22ef79de3878e2dc9913024521a71a792f35f5562f5720ba4b1441f9fc3052d4
Opcode Fuzzy Hash: 4d635e2390e09632c5a2c52a5ebdb9811b2924b89c763eaaebffbf58bfdbeb67
Instruction Fuzzy Hash: E63170314083829BC308EF65C8558AF7BE9BED5314F444E1DF4D5932A1EB20AA49CB63

Function 0061E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0061E645

Strings

1#INF, xrefs: 0061F852
1#QNAN, xrefs: 0061F84B
1#IND, xrefs: 0061F83D
1#SNAN, xrefs: 0061F844

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: ac2b2f96103a44d4bddda5ca6d04fd31b04d442125afb8124e28c3f6a5f18a43
Instruction ID: 0bcb0b891b8d63ca2755fbfbc4fa92b258759573225e9ae9ff72f2041b21797f
Opcode Fuzzy Hash: ac2b2f96103a44d4bddda5ca6d04fd31b04d442125afb8124e28c3f6a5f18a43
Instruction Fuzzy Hash: F2C23B71E046298FDB65CF289D407EAB7B6EB44305F1841EAD84DE7281E775AEC18F40

Function 0065648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 006564DC
CoInitialize.OLE32(00000000), ref: 00656639
CoCreateInstance.OLE32(0067FCF8,00000000,00000001,0067FB68,?), ref: 00656650
CoUninitialize.OLE32 ref: 006568D4

Strings

.lnk, xrefs: 006564BA, 00656524, 006565E0

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 048a90f170f1f89e15e543fa458108518153311aee94524533bd76af8dd45356
Instruction ID: f2329dc14018c29a49314ba794d4b7c2ed04184bbdbc55c31bc0d39ff6ab48c5
Opcode Fuzzy Hash: 048a90f170f1f89e15e543fa458108518153311aee94524533bd76af8dd45356
Instruction Fuzzy Hash: 2AD169715082419FC314EF24C8859ABBBE9FFD8304F40496DF5958B2A1EB30EE49CB92

Function 006622DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 006622E8

Part of subcall function 0065E4EC: GetWindowRect.USER32(?,?), ref: 0065E504

GetDesktopWindow.USER32 ref: 00662312
GetWindowRect.USER32(00000000), ref: 00662319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00662355
GetCursorPos.USER32(?), ref: 00662381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 006623DF

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 5558e3d27f418f39f087aa71373d9a87ebddbe551382f0b7df82ad1560e4cb5c
Instruction ID: 93d9971710887c5ee1badf0a662f334a09a8ef4d251a86cff15e6c001f9c6dfd
Opcode Fuzzy Hash: 5558e3d27f418f39f087aa71373d9a87ebddbe551382f0b7df82ad1560e4cb5c
Instruction Fuzzy Hash: 6131E272505716AFD724DF54C845B9BBBAAFF84320F00091DF989A7281DB35EA48CB92

Function 00659B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00659B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00659C8B

Part of subcall function 00653874: GetInputState.USER32 ref: 006538CB
Part of subcall function 00653874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00653966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00659BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00659C75

Strings

*.*, xrefs: 00659B5D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 3a0c6ec318993ac64b191d4f12107474b01546f9a1da684fc6184f2d60e681ee
Instruction ID: e5c6f7fc03d9f4852815d1d16e1240e267ebfc9a80ed81ef5844e217e2733e5c
Opcode Fuzzy Hash: 3a0c6ec318993ac64b191d4f12107474b01546f9a1da684fc6184f2d60e681ee
Instruction Fuzzy Hash: 3941517190420ADFDF58DF64C849AEE7BBAFF45311F244159F805A2291EB309E89CF60

Function 005F997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 005F9A4E
GetSysColor.USER32(0000000F), ref: 005F9B23
SetBkColor.GDI32(?,00000000), ref: 005F9B36

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 99cdccadf115b3c42afe6bc076c04d83cc0610eebc402a13ac429beea06491cb
Instruction ID: ece32333188b73f13ccf45392a048395943f461de088ee049823d34f6a306184
Opcode Fuzzy Hash: 99cdccadf115b3c42afe6bc076c04d83cc0610eebc402a13ac429beea06491cb
Instruction Fuzzy Hash: DEA121F0108848BFE738AA3C8C59FBB2D9FFB83350F154509F652C6695CA299D41D2B5

Function 00661806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0066304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0066307A
Part of subcall function 0066304E: _wcslen.LIBCMT ref: 0066309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0066185D
WSAGetLastError.WSOCK32 ref: 00661884
bind.WSOCK32(00000000,?,00000010), ref: 006618DB
WSAGetLastError.WSOCK32 ref: 006618E6
closesocket.WSOCK32(00000000), ref: 00661915

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 10858f898bbc1a6bb722287a3ee05419be4819342666eaa0ab4c6d8cc62f610d
Instruction ID: c996e8ca1333c438d9206a9d8ba1d94c3d9265711a27f6f9f63b45a40cbdbdfa
Opcode Fuzzy Hash: 10858f898bbc1a6bb722287a3ee05419be4819342666eaa0ab4c6d8cc62f610d
Instruction Fuzzy Hash: AF51C571A002009FDB14EF24C88AF6A7BE6AB85718F08845CF9555F3C3D775ED418BA1

Function 00671C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00671CC0
IsWindowEnabled.USER32 ref: 00671CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00671CDB
IsIconic.USER32 ref: 00671CE9
IsZoomed.USER32 ref: 00671CF7

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 305e6659c02c99fc8aacf19fc6f6df92c502030280a4df5c3679a05df0b078c6
Instruction ID: 0f0ea23c1f888fcfa21030defa37a3255b6602d6547d729d3498133d1f3ae37f
Opcode Fuzzy Hash: 305e6659c02c99fc8aacf19fc6f6df92c502030280a4df5c3679a05df0b078c6
Instruction Fuzzy Hash: CF21B1317402015FD7258F6EC894B6A7BA6AF86324B19C05EE84E8F352CB75DC42CB90

Function 005E8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00625DF0
VUUU, xrefs: 005E83E8
ERCP, xrefs: 005E813C
VUUU, xrefs: 005E83FA
VUUU, xrefs: 005E843C

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 2801d17a98d5e6bdd08b2ea32f9bdfe1cc10ec1af87d4dfdafdbaf761bb2da53
Instruction ID: 11181399345b301a2f2aabe61b4474477bd67ebddce57821283cd16191e57ca7
Opcode Fuzzy Hash: 2801d17a98d5e6bdd08b2ea32f9bdfe1cc10ec1af87d4dfdafdbaf761bb2da53
Instruction Fuzzy Hash: 5DA27E70A0066ACBDF28CF59D9407FDBBB2BB54314F24859AE85AA7385DB309D81CF50

Function 00648298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 006482AA

Strings

tbj, xrefs: 006484F4
(, xrefs: 006482F0
|, xrefs: 006482DA

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($tbj$|
API String ID: 1659193697-2372207717
Opcode ID: 34154801b52594ba7930da733c599e5bb56ec416f9dc8f85eb676b6e9292b846
Instruction ID: 84103af8e9ed4944c1b15361bb6b537a3d8fbfc5931c88808fa09d2603149d12
Opcode Fuzzy Hash: 34154801b52594ba7930da733c599e5bb56ec416f9dc8f85eb676b6e9292b846
Instruction Fuzzy Hash: F6323474A00605DFCB28CF59C481AAAB7F1FF48710B15C46EE59ADB7A1EB70E981CB44

Function 0066A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0066A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0066A6BA

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0066A79C
CloseHandle.KERNEL32(00000000), ref: 0066A7AB

Part of subcall function 005FCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00623303,?), ref: 005FCE8A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 157ec2217e64a6ff908e5d5c09058ce36faed1199dee2bd2eb3275ec49dad149
Instruction ID: 925a750ee049d3e44a7fc5be352471e2726e0a376c41ee781842dbfb4be443db
Opcode Fuzzy Hash: 157ec2217e64a6ff908e5d5c09058ce36faed1199dee2bd2eb3275ec49dad149
Instruction Fuzzy Hash: 6E518E715083419FC714EF25C88AA6BBBE9FFC8754F40492DF58997252EB30E904CB92

Function 0064AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0064AAAC
SetKeyboardState.USER32(00000080), ref: 0064AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0064AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0064AB88

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d3c8f8ba50c1102d269fef1ec525c740b6eaba167b6792a0fac313d65169ea1c
Instruction ID: 2113d363cba2c28707ff46eedd7373a61274a9228ed063c5584d2a75c04eee4d
Opcode Fuzzy Hash: d3c8f8ba50c1102d269fef1ec525c740b6eaba167b6792a0fac313d65169ea1c
Instruction Fuzzy Hash: D231D270AC0248BFFB258AA4CC05BFA7BA7EB45320F04421AE585966D1D3758981C766

Function 0061BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0061BB7F

Part of subcall function 006129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000), ref: 006129DE
Part of subcall function 006129C8: GetLastError.KERNEL32(00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000,00000000), ref: 006129F0

GetTimeZoneInformation.KERNEL32 ref: 0061BB91
WideCharToMultiByte.KERNEL32(00000000,?,006B121C,000000FF,?,0000003F,?,?), ref: 0061BC09
WideCharToMultiByte.KERNEL32(00000000,?,006B1270,000000FF,?,0000003F,?,?,?,006B121C,000000FF,?,0000003F,?,?), ref: 0061BC36

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 622eb6f21c85324a768af60293b47014eeb3ef085cea7a92b6404e764fe0e3ba
Instruction ID: e6a1a854a918c2cd385b87bfda1447a887715c7ddfe7edd1e797744dc208c98f
Opcode Fuzzy Hash: 622eb6f21c85324a768af60293b47014eeb3ef085cea7a92b6404e764fe0e3ba
Instruction Fuzzy Hash: A431A2B0904205EFCB15DF69CC904ADBBBABF4671075862AEE064DB3A1D7319ED1CB90

Function 0065CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0065CE89
GetLastError.KERNEL32(?,00000000), ref: 0065CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0065CEFE

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: d43a39fe74def809f8ef01d4a82c5caf2283912482f47e44bb7a6404f0d27799
Instruction ID: 1ff8aa2f897046c12b35aff21b7ae70ccbe44658303ac24086df0023f4c9e831
Opcode Fuzzy Hash: d43a39fe74def809f8ef01d4a82c5caf2283912482f47e44bb7a6404f0d27799
Instruction Fuzzy Hash: 6221BDB15003059FE720DFA5C949BA777FAEF00329F10481EE946A2291E770EE498B54

Function 00655C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00655CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00655D17
FindClose.KERNEL32(?), ref: 00655D5F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 1b29ef6c9d92b0c1ad113a8e6a0389a1e69854db8a0c624b0272c0399239f1bc
Instruction ID: 8379434c57ab2e856b52c464ee762d9e5260a2fbf281cb92b4b4562223b9e272
Opcode Fuzzy Hash: 1b29ef6c9d92b0c1ad113a8e6a0389a1e69854db8a0c624b0272c0399239f1bc
Instruction Fuzzy Hash: 35519E356046019FC718DF28C4A8A96BBF5FF49314F14865DE9AA8B3A1CB30ED45CF91

Function 00612622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0061271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00612724
UnhandledExceptionFilter.KERNEL32(?), ref: 00612731

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 365b9c1ed5bc9b507dc647703f9a302039a4d39907c0535a5551ba10bf7b388d
Instruction ID: feae3c539129c2b7dfaafd0f7e4e010127e5bcc5efb3e20ecc9365b031130d73
Opcode Fuzzy Hash: 365b9c1ed5bc9b507dc647703f9a302039a4d39907c0535a5551ba10bf7b388d
Instruction Fuzzy Hash: 9F31D5749412199BCB65DF68DC887DDB7B9AF08320F5041EAE41CA72A1E7309FC18F45

Function 006551CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006551DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00655238
SetErrorMode.KERNEL32(00000000), ref: 006552A1

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: ba6e6ef61a346cde2d00a804983db5a699d120b4d9d946cf2d904088ef1c4468
Instruction ID: 3af4fd55bec34b5da88fa27de2c21a35ab8412b6536b1a5ca2a44f0d7b5d86f0
Opcode Fuzzy Hash: ba6e6ef61a346cde2d00a804983db5a699d120b4d9d946cf2d904088ef1c4468
Instruction Fuzzy Hash: 31318E35A00609DFDB00DF54D888EADBBB5FF48314F048099E849AB362DB31ED5ACB90

Function 006416C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 005FFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00600668
Part of subcall function 005FFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00600685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0064170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0064173A
GetLastError.KERNEL32 ref: 0064174A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 46296fce7f6215f46893e8da2b706df533366b34dfe874aeb82449cdcd0bf6be
Instruction ID: 9828fde58adca24a912df731eb4d204ae29027adeab206212582a19bef80418b
Opcode Fuzzy Hash: 46296fce7f6215f46893e8da2b706df533366b34dfe874aeb82449cdcd0bf6be
Instruction Fuzzy Hash: 8C11C4B1400309AFD7189F64DC86DAABBBAFF44724B20852EE05697641EB70FC818B60

Function 0064D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0064D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0064D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0064D650

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 86b9a5d7a7db5c262c4c8c4f9e711b6c6d5ee138c80bc5a234e9e933537df0c1
Instruction ID: d8ff92be5f261ea625d9c31517ea16bf9d71f47d887e5d94c3d4353e019a05f5
Opcode Fuzzy Hash: 86b9a5d7a7db5c262c4c8c4f9e711b6c6d5ee138c80bc5a234e9e933537df0c1
Instruction Fuzzy Hash: CF118E71E01228BFDB108F98DC44FAFBBBDEB45B60F108125F908E7290D2704A018BA1

Function 00641663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0064168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 006416A1
FreeSid.ADVAPI32(?), ref: 006416B1

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 64fd99ccc4221549fb9be27e96980c8c78c6d282eab5255dede491689acad734
Instruction ID: 3751ac3ffdd67bc93d146f482e082e427b639ea26292b6c5e2c7d7c73f99ebbe
Opcode Fuzzy Hash: 64fd99ccc4221549fb9be27e96980c8c78c6d282eab5255dede491689acad734
Instruction Fuzzy Hash: F0F0F471950309FBDB00DFE49C89EAEBBBDFB08614F504565E501E2181E775AA848BA0

Function 00604CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(006128E9,?,00604CBE,006128E9,006A88B8,0000000C,00604E15,006128E9,00000002,00000000,?,006128E9), ref: 00604D09
TerminateProcess.KERNEL32(00000000,?,00604CBE,006128E9,006A88B8,0000000C,00604E15,006128E9,00000002,00000000,?,006128E9), ref: 00604D10
ExitProcess.KERNEL32 ref: 00604D22

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 381d44176af761eb3dda8cd44c483985f2eec9d5846041dccf9a7bbb114cd0b2
Instruction ID: 0a0e0fbd59ae6d1757a08f0b9d7039c9f0d1806f530175eddaddb3062c0c2de5
Opcode Fuzzy Hash: 381d44176af761eb3dda8cd44c483985f2eec9d5846041dccf9a7bbb114cd0b2
Instruction Fuzzy Hash: 29E0B671040648BBCF29AF54DD09A993B6BEF417A5B144018FD099A2B2DF35DD82CA84

Function 0063D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0063D28C

Strings

X64, xrefs: 0063D2A8

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: df0e62c1e6fb3f5d36abb39869f80e6c108b65d2c4adfb60d381eb41c50dbdba
Instruction ID: 8581e6b224ab77eb03bcdc75ad75d95c53a8892a65c218b3aca77a35f4bf738f
Opcode Fuzzy Hash: df0e62c1e6fb3f5d36abb39869f80e6c108b65d2c4adfb60d381eb41c50dbdba
Instruction Fuzzy Hash: 8FD0C9B480111DEACF94CB90EC88DDAB77DBB04305F100555F606A2000DB3496499F60

Function 0060CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: efc678778fc684133a51391029ea18367d33ea18eac0f021ac7692d0911d7184
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 71020C71E401199FDF18CFA9D8806EEBBF2EF48324F254269D919EB384D731A941CB94

Function 005ECAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

p#k, xrefs: 005ECF7F
Variable is not of type 'Object'., xrefs: 00630C40

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#k
API String ID: 0-2343768061
Opcode ID: 607e575eef7898fd2ba840427211b0ed0e9710dace956c647806091c9c38b2bb
Instruction ID: 41927a632a055bc58974f20d3de3b07698007801bac9cb3db7cf4d05e3437179
Opcode Fuzzy Hash: 607e575eef7898fd2ba840427211b0ed0e9710dace956c647806091c9c38b2bb
Instruction Fuzzy Hash: 9032AB70900259DFDF18DF91C995AEDBFBABF44304F204059E896AB282D735ED4ACB50

Function 006568EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00656918
FindClose.KERNEL32(00000000), ref: 00656961

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 62d70a52914aac7f0f66f1fc7e6d990e460119a0625f0573ae663e7cd448d74a
Instruction ID: b7931a13bff1fcdd8a1b927dd4dbfe1daa9e696325c258d1d5935f008b594595
Opcode Fuzzy Hash: 62d70a52914aac7f0f66f1fc7e6d990e460119a0625f0573ae663e7cd448d74a
Instruction Fuzzy Hash: 1F11AF316042019FC714CF29D488A16BBE1FF84329F44C699F8698B3A2CB30EC45CB91

Function 006537B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00664891,?,?,00000035,?), ref: 006537E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00664891,?,?,00000035,?), ref: 006537F4

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 7ce246d044b08ec84c041eb31447b5e92df5eee1870d8df55cec9a5190cd05b8
Instruction ID: 5cf26298b4ef12b29245c71fdaabff443a548d95efa7cc492ca6178efbfd3ced
Opcode Fuzzy Hash: 7ce246d044b08ec84c041eb31447b5e92df5eee1870d8df55cec9a5190cd05b8
Instruction Fuzzy Hash: FBF0A7706043252AE71017765C4DFDB3A9FEFC5771F000165B509D2281D960594486B0

Function 006410BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006411FC), ref: 006410D4
CloseHandle.KERNEL32(?,?,006411FC), ref: 006410E9

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 350b543634d62900c2ce3dc6e1b846afb5ff79e0c76c809b6b3137846c43a211
Instruction ID: 8a7c0da5c5da320c03cbf47464acd4763126154906b04f21fe4ebff26056aed9
Opcode Fuzzy Hash: 350b543634d62900c2ce3dc6e1b846afb5ff79e0c76c809b6b3137846c43a211
Instruction Fuzzy Hash: 7AE0BF72014611AEF7252B61FC09E777BAAFF04720B14882DF5A5844B1DB626CD0DB50

Function 005EBF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#k, xrefs: 006307CE

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#k
API String ID: 3964851224-3480846067
Opcode ID: 222654d904e2c8ed7803da40be581cde123b4c41145bcedb25ac4fdfbddda334
Instruction ID: 91ba25d99ca0f0ddf708fd2cb8b11775f44eb5fd310320703da7bfb3d1d7b516
Opcode Fuzzy Hash: 222654d904e2c8ed7803da40be581cde123b4c41145bcedb25ac4fdfbddda334
Instruction Fuzzy Hash: 7DA259706083419FD718CF29C494B6ABFE1BF89304F14896DE99A8B352D731EC46CB92

Function 0061676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00616766,?,?,00000008,?,?,0061FEFE,00000000), ref: 00616998

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 0dda52b43f4f123a43a3f68aca3bde5b4c2db896d30fac350d1a907458b5bcea
Instruction ID: f71397cfec9e4e16108660afe205f61f009fd5fbcc883c2a8eea388cc7f76c65
Opcode Fuzzy Hash: 0dda52b43f4f123a43a3f68aca3bde5b4c2db896d30fac350d1a907458b5bcea
Instruction Fuzzy Hash: 65B14B396106099FD715CF28C486BE57BE1FF45364F298658F89ACF2A2C335E992CB40

Function 005FB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0063851F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 8a9898f8e2676e52d6d83aabc7580a0f44725ff2d773ce1ad7aa1e1b10b6f4ba
Instruction ID: b7a92bde5cf28003a7bb6a64466ae2eba638a02fae7e87b6831126f2eb737a0b
Opcode Fuzzy Hash: 8a9898f8e2676e52d6d83aabc7580a0f44725ff2d773ce1ad7aa1e1b10b6f4ba
Instruction Fuzzy Hash: E9124D71900229DFDF14CF58C9816FEBBB6FF48710F14819AE949EB255EB349A81CB90

Function 0065EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0065EABD

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: eca9f20db209f54ffd180c67b5a6f3ba276fb506a11efb3dbc0d49b46b42d545
Instruction ID: 09a0df82b9112cc12f06c47f515c3a05a1302faaa6ad209f70b0046bf1d61b4b
Opcode Fuzzy Hash: eca9f20db209f54ffd180c67b5a6f3ba276fb506a11efb3dbc0d49b46b42d545
Instruction Fuzzy Hash: A8E01A312002059FD714EF6AD848E9ABBEEBF98761F00841AFD4AC7351DA71E9458B90

Function 006009D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,006003EE), ref: 006009DA

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a54c304c889e04c2e520d458d377545b77e5678e5d16035585115f7f199e0f8e
Instruction ID: b7ff286092e50a4541089129221c75c503fb04c548906156d47f46dd29a29381
Opcode Fuzzy Hash: a54c304c889e04c2e520d458d377545b77e5678e5d16035585115f7f199e0f8e
Instruction Fuzzy Hash:

Function 0060781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0060798B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 13494bc7800c11ea0913492aeccdc7bc7ed035c14d54938e5a74f044b3aa7faa
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: FC515961FCC6455BDB3C8568885D7FF63879B52300F18852AD886D73C2CA15FE42D36A

Function 00652046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&k, xrefs: 00652053

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID: 0&k
API String ID: 0-3264481142
Opcode ID: 35cf5c283b6673ef2ba286b2d1c46d83ded76f024b050c01aefe5ac4f6f38886
Instruction ID: 399d522470fb9255869d2aaccb39e9c2a1a70b4cdb228982d3d46e43fac3f13a
Opcode Fuzzy Hash: 35cf5c283b6673ef2ba286b2d1c46d83ded76f024b050c01aefe5ac4f6f38886
Instruction Fuzzy Hash: B921BB726615118BD72CCF79C8236BE73E6A754310F15862EE4A7C77D0DE35A944C740

Function 00616DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d4f61b558c71a5829259ea52b0cf25dfa2d7345998e1277cfcbb537052f18d4
Instruction ID: bd4724d6720de67db9d93434d7071098a867e3779116591335fbf8a8a0f1cae1
Opcode Fuzzy Hash: 1d4f61b558c71a5829259ea52b0cf25dfa2d7345998e1277cfcbb537052f18d4
Instruction Fuzzy Hash: F7320331D29F014DD7239634D832375A69AAFB73C5F19D737E81AB5AA5EB29C4C34200

Function 005FCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9575f44f9fb34fd672067777c0ed4126423ec66feb302f205dec4dfe883abbc
Instruction ID: 21dfa1360da2c4b7bd1c0ef4907cf3d506a32e83d54e217211586c83d8ee217a
Opcode Fuzzy Hash: b9575f44f9fb34fd672067777c0ed4126423ec66feb302f205dec4dfe883abbc
Instruction Fuzzy Hash: 58320631A0015D8BCF24DB29C5946BD7FA3FF45320F28856AF95AAB391D634DD81DB80

Function 005E7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e12c78705d63e0affc5d2bcdfa23c4356865b1207839771ad7239a6799f3d519
Instruction ID: 6ab3332d3335d41ab2d0cc6a3ade7759f63c3f67306f4b0e197aa8da563abc6a
Opcode Fuzzy Hash: e12c78705d63e0affc5d2bcdfa23c4356865b1207839771ad7239a6799f3d519
Instruction Fuzzy Hash: 0622C070A04A5ADFDF18DF65D881AAEBBF6FF48300F104529E852A7291EB35AD11CF50

Function 005E91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed6fb587def6e53198a282640aa68a345444235fba65be8fc69947992136d1b
Instruction ID: 4d1f439251f68b7108b8fcfa3b408f2d2501bae4d8641717b16e47de21a3c5dc
Opcode Fuzzy Hash: eed6fb587def6e53198a282640aa68a345444235fba65be8fc69947992136d1b
Instruction Fuzzy Hash: 0302D6B0E0061AEBDF04DF55D885AAEBBB2FF44300F108569E9569B391E731AE11CF91

Function 00619EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a38073bc4e01d690bfec1a4fbd840091189e56dbee9735b92018dc5dbc4b1a9
Instruction ID: 01537507779d5d5959b563531eb34a6b2fec578b50b56e5e99469810d048154a
Opcode Fuzzy Hash: 4a38073bc4e01d690bfec1a4fbd840091189e56dbee9735b92018dc5dbc4b1a9
Instruction Fuzzy Hash: FBB1F430D2AF905ED72396398831336B65D6FBB6D5F51E71BFC1674E22EB2185834240

Function 00601C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 645f0bf3a456bf455d1fc7ee922ffb0ed0d3cd90ae75c8af9a5908b279c20bce
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: DD9157725880A34ADB2D463A85740BFFFE25E933A131A079DD4F2CE2C5FE14D955D620

Function 00601F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: e9609c0464459400b0b41f62ebbe71cc634709c9f98272ee0897c514cd67f4ca
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: B49175726491A34ADB6D423A847807FFFE35E923A131A07DDD5F2CF2C5EE248554D620

Function 006019B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: aafea6beff6574688e2d08ea36c4f0ecead3608362a745056c5dd07a2b5ae2f2
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: D59154726890A34ADB2D427A857407FFFE25A933A131A079DD4F2CE2C1FE14C655D620

Function 00607A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe48bb53bee526dd4c78a07af0508160a38389adbf219fa0fecf5b45bce684a
Instruction ID: 4a9ed6ab4ec003b5d0c2762183e313bf82b8bf4fa35802dd8179b525a136336b
Opcode Fuzzy Hash: bbe48bb53bee526dd4c78a07af0508160a38389adbf219fa0fecf5b45bce684a
Instruction Fuzzy Hash: 61612321FC87496AEA7C9D2889A5BFF3397DB51300F10091DE882CB3C1DB51BE428369

Function 00607CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c4ccb032dd30ec61fcb4a08400618765d79746e9c0e8eab4b86bedde211202
Instruction ID: adefa82553dfde103bba0e343f4d7ce9fd3edb53a373af199a993a9ba78364ea
Opcode Fuzzy Hash: b9c4ccb032dd30ec61fcb4a08400618765d79746e9c0e8eab4b86bedde211202
Instruction Fuzzy Hash: 5E616971EC870966DE3C9A289855BFF2397EF42704F10095DE982DB3C1EA52FD428359

Function 00601706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 95781a0f35a8c7fb11fdbed5ce78265a8abd8701911d58c0e4c7b5aedbb80b2b
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: BD8165326490A34ADB6D427A85744BFFFE35A933A131A479DD4F2CE2C1FE24C654D620

Function 00662ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00662B30
DeleteObject.GDI32(00000000), ref: 00662B43
DestroyWindow.USER32 ref: 00662B52
GetDesktopWindow.USER32 ref: 00662B6D
GetWindowRect.USER32(00000000), ref: 00662B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00662CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00662CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662CF8
GetClientRect.USER32(00000000,?), ref: 00662D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00662D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662DA8
GlobalFree.KERNEL32(00000000), ref: 00662DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0067FC38,00000000), ref: 00662DDB
GlobalFree.KERNEL32(00000000), ref: 00662DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00662E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00662E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00662E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0066303F

Strings

static, xrefs: 00662D3A, 00662E91
, xrefs: 00662FC5
DISPLAY, xrefs: 00662EA2
AutoIt v3, xrefs: 00662CF2

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: e69520ce339e2e2dd2e5681bddc6cada40047d752e4a99b79b099c06631a9167
Instruction ID: ee71c9b7040162a05baec70188f88af251824b27137c2bcf18f950d458c3d578
Opcode Fuzzy Hash: e69520ce339e2e2dd2e5681bddc6cada40047d752e4a99b79b099c06631a9167
Instruction Fuzzy Hash: FA028D71500205EFDB18DF64CC99EAE7BBAFF49720F048159F919AB2A1DB70AD41CB60

Function 006770D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0067712F
GetSysColorBrush.USER32(0000000F), ref: 00677160
GetSysColor.USER32(0000000F), ref: 0067716C
SetBkColor.GDI32(?,000000FF), ref: 00677186
SelectObject.GDI32(?,?), ref: 00677195
InflateRect.USER32(?,000000FF,000000FF), ref: 006771C0
GetSysColor.USER32(00000010), ref: 006771C8
CreateSolidBrush.GDI32(00000000), ref: 006771CF
FrameRect.USER32(?,?,00000000), ref: 006771DE
DeleteObject.GDI32(00000000), ref: 006771E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00677230
FillRect.USER32(?,?,?), ref: 00677262
GetWindowLongW.USER32(?,000000F0), ref: 00677284

Part of subcall function 006773E8: GetSysColor.USER32(00000012), ref: 00677421
Part of subcall function 006773E8: SetTextColor.GDI32(?,?), ref: 00677425
Part of subcall function 006773E8: GetSysColorBrush.USER32(0000000F), ref: 0067743B
Part of subcall function 006773E8: GetSysColor.USER32(0000000F), ref: 00677446
Part of subcall function 006773E8: GetSysColor.USER32(00000011), ref: 00677463
Part of subcall function 006773E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00677471
Part of subcall function 006773E8: SelectObject.GDI32(?,00000000), ref: 00677482
Part of subcall function 006773E8: SetBkColor.GDI32(?,00000000), ref: 0067748B
Part of subcall function 006773E8: SelectObject.GDI32(?,?), ref: 00677498
Part of subcall function 006773E8: InflateRect.USER32(?,000000FF,000000FF), ref: 006774B7
Part of subcall function 006773E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 006774CE
Part of subcall function 006773E8: GetWindowLongW.USER32(00000000,000000F0), ref: 006774DB

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 52238df205ffed6e8cc9399f8732f28ccd77b340fab4d13a19d37073868822f9
Instruction ID: 10fb706fb82f38d7c2be258d644866c23d50567f65d58350f603a65aa678fe02
Opcode Fuzzy Hash: 52238df205ffed6e8cc9399f8732f28ccd77b340fab4d13a19d37073868822f9
Instruction Fuzzy Hash: ADA1A072008301AFD704DF64DC48A6B7BAAFF49331F105A2DFA6A961E1D771E984CB51

Function 005F8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 005F8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00636AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00636AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00636F43

Part of subcall function 005F8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,005F8BE8,?,00000000,?,?,?,?,005F8BBA,00000000,?), ref: 005F8FC5

SendMessageW.USER32(?,00001053), ref: 00636F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00636F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00636FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00636FB7

Strings

0, xrefs: 00636DCF

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: d48d8f85aebfc4657b09eea48f0c25087c98189038144caf8fcaec0d06de8cd2
Instruction ID: 6b7f7758b7c3ad2f8421fbf4b4ed56d453daea21c9bc0262d2f37e9c37617962
Opcode Fuzzy Hash: d48d8f85aebfc4657b09eea48f0c25087c98189038144caf8fcaec0d06de8cd2
Instruction Fuzzy Hash: D612BC30204641AFDB25DF14C898BB6BBE6FF45310F54856DF6898B261CB36AC92CB91

Function 00662711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0066273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0066286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 006628A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 006628B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00662900
GetClientRect.USER32(00000000,?), ref: 0066290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00662955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00662964
GetStockObject.GDI32(00000011), ref: 00662974
SelectObject.GDI32(00000000,00000000), ref: 00662978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00662988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00662991
DeleteDC.GDI32(00000000), ref: 0066299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 006629C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 006629DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00662A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00662A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00662A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00662A77
GetStockObject.GDI32(00000011), ref: 00662A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00662A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00662A97

Strings

static, xrefs: 0066294F, 00662A71
DISPLAY, xrefs: 0066295A
AutoIt v3, xrefs: 006628F8
msctls_progress32, xrefs: 00662A13

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 37eafa6a532194deff6da36cef4feff5377335989bca333ac180b159148d069f
Instruction ID: adb202461afba287201e4c20b5ca683b79e919c8d1979de84531947c33aec655
Opcode Fuzzy Hash: 37eafa6a532194deff6da36cef4feff5377335989bca333ac180b159148d069f
Instruction Fuzzy Hash: B2B15CB1A00605BFEB14DF69DC99FAE7BAAFB49710F104219F915EB290D770AD40CB90

Function 00654ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00654AED
GetDriveTypeW.KERNEL32(?,0067CB68,?,\\.\,0067CC08), ref: 00654BCA
SetErrorMode.KERNEL32(00000000,0067CB68,?,\\.\,0067CC08), ref: 00654D36

Strings

SSA, xrefs: 00654CA6
Fibre, xrefs: 00654CAD
SSD, xrefs: 00654C4A
SAS, xrefs: 00654CC9
FileBackedVirtual, xrefs: 00654CEC
ATAPI, xrefs: 00654C91
Virtual, xrefs: 00654CE5
Network, xrefs: 00654C02
USB, xrefs: 00654CB4
RAMDisk, xrefs: 00654BF4
Fixed, xrefs: 00654C09
iSCSI, xrefs: 00654CC2
RAID, xrefs: 00654CBB
1394, xrefs: 00654C9F
Removable, xrefs: 00654C10, 00654C15
\\.\, xrefs: 00654B3F
ATA, xrefs: 00654C98
SATA, xrefs: 00654CD0
MMC, xrefs: 00654CDE
PhysicalDrive, xrefs: 00654B76
SCSI, xrefs: 00654C8A
CDROM, xrefs: 00654BFB
Unknown, xrefs: 00654BED, 00654C83

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: dc9e6084ea0fad41df773ebc9f912c7f8dad71c5c9a2ac77fce3167b2e9b7d27
Instruction ID: a17ffe52fae2c6b70dc0918df677f02583e0e65149578382e2eb3e5356afc6db
Opcode Fuzzy Hash: dc9e6084ea0fad41df773ebc9f912c7f8dad71c5c9a2ac77fce3167b2e9b7d27
Instruction Fuzzy Hash: 8F61B430606106ABCB08EF24C9859AC7BB3AF8534AF244495FC06AB291DF31DDCADF41

Function 006773E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00677421
SetTextColor.GDI32(?,?), ref: 00677425
GetSysColorBrush.USER32(0000000F), ref: 0067743B
GetSysColor.USER32(0000000F), ref: 00677446
CreateSolidBrush.GDI32(?), ref: 0067744B
GetSysColor.USER32(00000011), ref: 00677463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00677471
SelectObject.GDI32(?,00000000), ref: 00677482
SetBkColor.GDI32(?,00000000), ref: 0067748B
SelectObject.GDI32(?,?), ref: 00677498
InflateRect.USER32(?,000000FF,000000FF), ref: 006774B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 006774CE
GetWindowLongW.USER32(00000000,000000F0), ref: 006774DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0067752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00677554
InflateRect.USER32(?,000000FD,000000FD), ref: 00677572
DrawFocusRect.USER32(?,?), ref: 0067757D
GetSysColor.USER32(00000011), ref: 0067758E
SetTextColor.GDI32(?,00000000), ref: 00677596
DrawTextW.USER32(?,006770F5,000000FF,?,00000000), ref: 006775A8
SelectObject.GDI32(?,?), ref: 006775BF
DeleteObject.GDI32(?), ref: 006775CA
SelectObject.GDI32(?,?), ref: 006775D0
DeleteObject.GDI32(?), ref: 006775D5
SetTextColor.GDI32(?,?), ref: 006775DB
SetBkColor.GDI32(?,?), ref: 006775E5

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 279d02df2c54a6a4f75741c7d6d91847fccb0738e02b3e521449667a1921c295
Instruction ID: a1cf8325c3470dd92885f61ff8a68231a3e4ae46ab378eda70a81d03aebfa8bd
Opcode Fuzzy Hash: 279d02df2c54a6a4f75741c7d6d91847fccb0738e02b3e521449667a1921c295
Instruction Fuzzy Hash: 4B615272900218AFDF05DFA4DC49AEE7FBAEB09320F115125F919A72A1D7759980CF90

Function 00670FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00671128
GetDesktopWindow.USER32 ref: 0067113D
GetWindowRect.USER32(00000000), ref: 00671144
GetWindowLongW.USER32(?,000000F0), ref: 00671199
DestroyWindow.USER32(?), ref: 006711B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 006711ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0067120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0067121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00671232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00671245
IsWindowVisible.USER32(00000000), ref: 006712A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 006712BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 006712D0
GetWindowRect.USER32(00000000,?), ref: 006712E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0067130E
GetMonitorInfoW.USER32(00000000,?), ref: 00671328
CopyRect.USER32(?,?), ref: 0067133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 006713AA

Strings

0, xrefs: 006710D3
tooltips_class32, xrefs: 006711E6
(, xrefs: 0067131B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 2e1f44a3645fceae145b1b7bb401f6f9e7ef52c7c13557e6ae257f26edd80d09
Instruction ID: 731120b72736d908a7d4f2e0f93afafb10ab34cef937f417b3748a48c6ce936d
Opcode Fuzzy Hash: 2e1f44a3645fceae145b1b7bb401f6f9e7ef52c7c13557e6ae257f26edd80d09
Instruction Fuzzy Hash: D3B19C71608341AFD704DF69C888BAABBE5FF85310F00891EF99D9B261DB31E844CB91

Function 005F8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 005F8968
GetSystemMetrics.USER32(00000007), ref: 005F8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 005F899B
GetSystemMetrics.USER32(00000008), ref: 005F89A3
GetSystemMetrics.USER32(00000004), ref: 005F89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 005F89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 005F89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 005F8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 005F8A3C
GetClientRect.USER32(00000000,000000FF), ref: 005F8A5A
GetStockObject.GDI32(00000011), ref: 005F8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 005F8A81

Part of subcall function 005F912D: GetCursorPos.USER32(?), ref: 005F9141
Part of subcall function 005F912D: ScreenToClient.USER32(00000000,?), ref: 005F915E
Part of subcall function 005F912D: GetAsyncKeyState.USER32(00000001), ref: 005F9183
Part of subcall function 005F912D: GetAsyncKeyState.USER32(00000002), ref: 005F919D

SetTimer.USER32(00000000,00000000,00000028,005F90FC), ref: 005F8AA8

Strings

AutoIt v3 GUI, xrefs: 005F8A20

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 4a1ad8c5b2ec9ad6df65d6066d8e9ea031d9878c76729c35300591fd38f1bd9b
Instruction ID: 42c103a7a19b9bc7e06032b37f468b94bcc3b2e06ba1f53f4c2fe57dd529b182
Opcode Fuzzy Hash: 4a1ad8c5b2ec9ad6df65d6066d8e9ea031d9878c76729c35300591fd38f1bd9b
Instruction Fuzzy Hash: 24B16F71A00209AFDF14DF68CD59BFE3BB6FB48314F104229FA15AB290DB74A991CB51

Function 00640D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006410F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00641114
Part of subcall function 006410F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 00641120
Part of subcall function 006410F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 0064112F
Part of subcall function 006410F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 00641136
Part of subcall function 006410F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0064114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00640DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00640E29
GetLengthSid.ADVAPI32(?), ref: 00640E40
GetAce.ADVAPI32(?,00000000,?), ref: 00640E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00640E96
GetLengthSid.ADVAPI32(?), ref: 00640EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00640EB5
HeapAlloc.KERNEL32(00000000), ref: 00640EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00640EDD
CopySid.ADVAPI32(00000000), ref: 00640EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00640F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00640F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00640F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00640F6E
HeapFree.KERNEL32(00000000), ref: 00640F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00640F7E
HeapFree.KERNEL32(00000000), ref: 00640F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00640F8E
HeapFree.KERNEL32(00000000), ref: 00640F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00640FA1
HeapFree.KERNEL32(00000000), ref: 00640FA8

Part of subcall function 00641193: GetProcessHeap.KERNEL32(00000008,00640BB1,?,00000000,?,00640BB1,?), ref: 006411A1
Part of subcall function 00641193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00640BB1,?), ref: 006411A8
Part of subcall function 00641193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00640BB1,?), ref: 006411B7

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c8a1b0aa94a2000a9af0ac98e4505d1033701cf6b012faaa2e6f8eb6b46eea60
Instruction ID: dd6e442af862a141fc539fd9a4e7f15467a3388496e9b737b616e4c1df295b0f
Opcode Fuzzy Hash: c8a1b0aa94a2000a9af0ac98e4505d1033701cf6b012faaa2e6f8eb6b46eea60
Instruction Fuzzy Hash: 0071607190021AEBEF609FA4DC44FEEBBBABF05310F148129FA19E7251D7359945CB60

Function 0066C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0066C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0067CC08,00000000,?,00000000,?,?), ref: 0066C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0066C5A4
_wcslen.LIBCMT ref: 0066C5F4
_wcslen.LIBCMT ref: 0066C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0066C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0066C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0066C84D
RegCloseKey.ADVAPI32(?), ref: 0066C881
RegCloseKey.ADVAPI32(00000000), ref: 0066C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0066C960

Strings

REG_BINARY, xrefs: 0066C913
REG_DWORD, xrefs: 0066C804
REG_EXPAND_SZ, xrefs: 0066C5CD
REG_MULTI_SZ, xrefs: 0066C6F5
REG_SZ, xrefs: 0066C644
REG_QWORD, xrefs: 0066C8C3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: e685fd2501b2422aacc8dd977058abf5c1ddf7fe1928b407ad5c1245c29bb2f4
Instruction ID: 0863c278310b6a5a09c0086d189f15dfe235af7670f3181dfb966f85e487cf30
Opcode Fuzzy Hash: e685fd2501b2422aacc8dd977058abf5c1ddf7fe1928b407ad5c1245c29bb2f4
Instruction Fuzzy Hash: 881268356046019FC718DF15C885A6ABBE6FF88724F04885DF89A9B3A2DB31EC41CB81

Function 0067091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 006709C6
_wcslen.LIBCMT ref: 00670A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00670A54
_wcslen.LIBCMT ref: 00670A8A
_wcslen.LIBCMT ref: 00670B06
_wcslen.LIBCMT ref: 00670B81

Part of subcall function 005FF9F2: _wcslen.LIBCMT ref: 005FF9FD

Part of subcall function 00642BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00642BFA

Strings

GETTOTALCOUNT, xrefs: 006709F2, 00670A17
GETITEMCOUNT, xrefs: 00670C1E
UNCHECK, xrefs: 00670D3E
EXPAND, xrefs: 00670BF8
SELECT, xrefs: 00670D11
COLLAPSE, xrefs: 00670B01, 00670B1C
GETSELECTED, xrefs: 00670C4E
ISCHECKED, xrefs: 00670CE1
GETTEXT, xrefs: 00670C97
EXISTS, xrefs: 00670B7C, 00670B97
CHECK, xrefs: 00670A85, 00670AA0

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 3c09b90402074e9869ea75e9636767458bd0bdfb8e7815352ba1855046e33e51
Instruction ID: 40ef7f9c0cf14825b07d1ee85209878f8b99111daff4f6d6cb9b73e3073370a6
Opcode Fuzzy Hash: 3c09b90402074e9869ea75e9636767458bd0bdfb8e7815352ba1855046e33e51
Instruction Fuzzy Hash: 3AE1BD35208342DFC714EF25C45096ABBE2BF98714F10895DF89A9B3A2D731ED46CBA1

Function 0066C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0066B6AE,?,?), ref: 0066C9B5
_wcslen.LIBCMT ref: 0066C9F1
_wcslen.LIBCMT ref: 0066CA68
_wcslen.LIBCMT ref: 0066CA9E
_wcslen.LIBCMT ref: 0066CAF9
_wcslen.LIBCMT ref: 0066CB2F
_wcslen.LIBCMT ref: 0066CB7F

Strings

HKLM, xrefs: 0066CA98, 0066CA9D
HKU, xrefs: 0066CBF0
HKEY_CURRENT_USER, xrefs: 0066CBBD
HKEY_CURRENT_CONFIG, xrefs: 0066CB79, 0066CB7E
HKEY_USERS, xrefs: 0066CBDF
HKEY_CLASSES_ROOT, xrefs: 0066CAF3, 0066CAF8
HKCC, xrefs: 0066CBAC
HKEY_LOCAL_MACHINE, xrefs: 0066CA62, 0066CA67
HKCU, xrefs: 0066CBCE
HKCR, xrefs: 0066CB29, 0066CB2E

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: c566f3dbda0c12d27e1cbf018a2e1c68d368fffb9b121efefa9fd8991a34fcd2
Instruction ID: f159f38854242bdef786d67c7600e8c7d2836fb19e7ae2ead13102cce897e510
Opcode Fuzzy Hash: c566f3dbda0c12d27e1cbf018a2e1c68d368fffb9b121efefa9fd8991a34fcd2
Instruction Fuzzy Hash: A171D23260096A8BCB20EEBCCD515FB3793AFA1774B250528F8D697384EA35DD4587A0

Function 0067833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0067835A
_wcslen.LIBCMT ref: 0067836E
_wcslen.LIBCMT ref: 00678391
_wcslen.LIBCMT ref: 006783B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 006783F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,0067361A,?), ref: 0067844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00678487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 006784CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00678501
FreeLibrary.KERNEL32(?), ref: 0067850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0067851D
DestroyIcon.USER32(?), ref: 0067852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00678549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00678555

Strings

.dll, xrefs: 006783AB
.icl, xrefs: 00678368
.exe, xrefs: 00678388

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 6735690d89abc4ff7071ea738f0c71fe98adb32ffafad833ff07599b8c90f230
Instruction ID: 11fe202f5de0cd236dc2512a3deb9059d4e2f922f5fb31645410f8f29a926ec7
Opcode Fuzzy Hash: 6735690d89abc4ff7071ea738f0c71fe98adb32ffafad833ff07599b8c90f230
Instruction Fuzzy Hash: 7561BF71580205BEEB28DF64CC49BFE7BA9BB04721F108509F919D61D1DFB49D90CBA0

Function 005E7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

Bad directive syntax error, xrefs: 0062519A
#requireadmin, xrefs: 005E77FF
#include-once, xrefs: 005E782F
#ce, xrefs: 005E78ED
#comments-start, xrefs: 005E785F, 005E78B1
#pragma compile, xrefs: 005E77D3
Cannot parse #include, xrefs: 00625279
#include, xrefs: 005E7847
#notrayicon, xrefs: 005E77E7
#comments-end, xrefs: 005E78D9
Unterminated group of comments, xrefs: 0062528C
#cs, xrefs: 005E7873, 005E78C5
#OnAutoItStartRegister, xrefs: 005E7817
', xrefs: 00625169
", xrefs: 00625153

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 49b6e0a79cd4a2490f8d9111dc82c30a08c7a6e0b9ab866d52b030f0645ed292
Instruction ID: bb349177214325b8344ea3d41da9b5a946676e4e3e1a3b166fd8471374e07509
Opcode Fuzzy Hash: 49b6e0a79cd4a2490f8d9111dc82c30a08c7a6e0b9ab866d52b030f0645ed292
Instruction Fuzzy Hash: 91811870A44619BBDB28AF21DC46FAF3B6AFF59300F044424F945AB1D2EB70DA51CB91

Function 00653E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00653EF8
_wcslen.LIBCMT ref: 00653F03
_wcslen.LIBCMT ref: 00653F5A
_wcslen.LIBCMT ref: 00653F98
GetDriveTypeW.KERNEL32(?), ref: 00653FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0065401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00654059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00654087

Strings

open , xrefs: 00653FE5
close, xrefs: 00653EFE, 00653F18
set cd door , xrefs: 00654028
open, xrefs: 00653F54, 00653F59
wait, xrefs: 00654044
closed, xrefs: 00653F08, 00653F2D, 00653F46, 00653F7E, 00653F97
type cdaudio alias cd wait, xrefs: 00654001
close cd wait, xrefs: 00654072

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 9e18f9abc367ea9c28c05487f561da7d5dc958784643b22c7312086f23f169cb
Instruction ID: f59db6177d5c91ea4716ba01d79b39ab4ad47bb18144f7f850481f03121490fd
Opcode Fuzzy Hash: 9e18f9abc367ea9c28c05487f561da7d5dc958784643b22c7312086f23f169cb
Instruction Fuzzy Hash: 1B71B0725042129FC314EF24C8808AABBE6FF947A8F14492DF9D697391EB31DD49CB91

Function 00645A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00645A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00645A40
SetWindowTextW.USER32(?,?), ref: 00645A57
GetDlgItem.USER32(?,000003EA), ref: 00645A6C
SetWindowTextW.USER32(00000000,?), ref: 00645A72
GetDlgItem.USER32(?,000003E9), ref: 00645A82
SetWindowTextW.USER32(00000000,?), ref: 00645A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00645AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00645AC3
GetWindowRect.USER32(?,?), ref: 00645ACC
_wcslen.LIBCMT ref: 00645B33
SetWindowTextW.USER32(?,?), ref: 00645B6F
GetDesktopWindow.USER32 ref: 00645B75
GetWindowRect.USER32(00000000), ref: 00645B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00645BD3
GetClientRect.USER32(?,?), ref: 00645BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00645C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00645C2F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 71ebb488dc07df63e9710b5ca967a3da3fd0ae04358a9b8c871841f5e147ae7b
Instruction ID: 2987a1bbd666da24f43ece84df31888e9d8a7211afb8de47bc7363a5633cd415
Opcode Fuzzy Hash: 71ebb488dc07df63e9710b5ca967a3da3fd0ae04358a9b8c871841f5e147ae7b
Instruction Fuzzy Hash: 6C719D31900B09AFDB24DFA8CE95AAEBBF6FF48714F10451CE547A26A1D771E940CB10

Function 0065FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0065FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0065FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0065FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0065FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0065FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0065FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0065FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0065FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0065FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0065FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0065FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0065FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0065FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0065FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0065FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0065FECC
GetCursorInfo.USER32(?), ref: 0065FEDC
GetLastError.KERNEL32 ref: 0065FF1E

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: a189cf4f3cad4fb0bbe0af22acd6217878eaeffb66285413a308ede3fb8d41f4
Instruction ID: 0c48c29073d4ea50130b627956b662b362926d364e104c89879fcfb3b3f44d95
Opcode Fuzzy Hash: a189cf4f3cad4fb0bbe0af22acd6217878eaeffb66285413a308ede3fb8d41f4
Instruction Fuzzy Hash: 124172B0D04319AADB109FBA8C8985EBFE9FF04354B50452AF51DE7281DB78E901CF91

Function 006430F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0064318D
_wcslen.LIBCMT ref: 006431F8

Strings

NAME, xrefs: 00643335, 00643346
INSTANCE, xrefs: 00643453
TEXT, xrefs: 0064347C
REGEXPCLASS, xrefs: 00643255, 00643266
CLASSNN, xrefs: 006431F3, 00643204
CLASS, xrefs: 00643188, 006431A5
[j, xrefs: 0064339A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[j
API String ID: 176396367-1297735480
Opcode ID: 77fe1c03dbd8f614afabc35caf82e5d3b24d5269d6228aabbba5de6fc5fb8efb
Instruction ID: 9ffacfdd0391f367b9f6a54b2f47322a80fd6ad816be4240a1adbbfe735a2dbc
Opcode Fuzzy Hash: 77fe1c03dbd8f614afabc35caf82e5d3b24d5269d6228aabbba5de6fc5fb8efb
Instruction Fuzzy Hash: 54E1D532A00536ABCB18DF78C4516EEBBB3BF54710F548129E456E7380DB70AF858BA0

Function 006000C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 006000C6

Part of subcall function 006000ED: InitializeCriticalSectionAndSpinCount.KERNEL32(006B070C,00000FA0,5EC454B9,?,?,?,?,006223B3,000000FF), ref: 0060011C
Part of subcall function 006000ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,006223B3,000000FF), ref: 00600127
Part of subcall function 006000ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,006223B3,000000FF), ref: 00600138
Part of subcall function 006000ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0060014E
Part of subcall function 006000ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0060015C
Part of subcall function 006000ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0060016A
Part of subcall function 006000ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00600195
Part of subcall function 006000ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 006001A0

___scrt_fastfail.LIBCMT ref: 006000E7

Part of subcall function 006000A3: __onexit.LIBCMT ref: 006000A9

Strings

WakeAllConditionVariable, xrefs: 00600162
kernel32.dll, xrefs: 00600133
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00600122
InitializeConditionVariable, xrefs: 00600148
SleepConditionVariableCS, xrefs: 00600154

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: ea27d716ac6567f02f741a5f6fd28fc15589a87952d8e855ad7586e2e2a4a4c0
Instruction ID: 0174132241de78e587f7c61128da65e441a809f08d260855e2cbb73b7849b478
Opcode Fuzzy Hash: ea27d716ac6567f02f741a5f6fd28fc15589a87952d8e855ad7586e2e2a4a4c0
Instruction Fuzzy Hash: 93214632A84701ABF7285BB4AC09F6B779BEF45B60F11013EF909A23D1DF7098408A90

Function 006544C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0067CC08), ref: 00654527
_wcslen.LIBCMT ref: 0065453B
_wcslen.LIBCMT ref: 00654599
_wcslen.LIBCMT ref: 006545F4
_wcslen.LIBCMT ref: 0065463F
_wcslen.LIBCMT ref: 006546A7

Part of subcall function 005FF9F2: _wcslen.LIBCMT ref: 005FF9FD

GetDriveTypeW.KERNEL32(?,006A6BF0,00000061), ref: 00654743

Strings

cdrom, xrefs: 0065458F, 00654594
removable, xrefs: 006545EA, 006545EF
all, xrefs: 00654531, 00654536
ramdisk, xrefs: 006546F1
unknown, xrefs: 00654708
fixed, xrefs: 00654635, 0065463A
network, xrefs: 0065469D, 006546A2

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 33d520e83d7f75bf2a18762a6149fd9c6cbcdaee3312992bb8e21826cc9a6f40
Instruction ID: 9c3d5afa9737cf1e2d8c0c2fe4f82dd388eab0851dff333f7325d6d47b209657
Opcode Fuzzy Hash: 33d520e83d7f75bf2a18762a6149fd9c6cbcdaee3312992bb8e21826cc9a6f40
Instruction Fuzzy Hash: 5BB105315083029FC714DF28C890AAAB7E6BFA5769F50495DF896C7391EB30DC89CB52

Function 0067911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

DragQueryPoint.SHELL32(?,?), ref: 00679147

Part of subcall function 00677674: ClientToScreen.USER32(?,?), ref: 0067769A
Part of subcall function 00677674: GetWindowRect.USER32(?,?), ref: 00677710
Part of subcall function 00677674: PtInRect.USER32(?,?,00678B89), ref: 00677720

SendMessageW.USER32(?,000000B0,?,?), ref: 006791B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 006791BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 006791DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00679225
SendMessageW.USER32(?,000000B0,?,?), ref: 0067923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00679255
SendMessageW.USER32(?,000000B1,?,?), ref: 00679277
DragFinish.SHELL32(?), ref: 0067927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00679371

Strings

@GUI_DRAGFILE, xrefs: 00679320
@GUI_DROPID, xrefs: 0067929E
@GUI_DRAGID, xrefs: 006792E9
p#k, xrefs: 006792BB

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#k
API String ID: 221274066-2854851725
Opcode ID: 3e73f91e635fbd67d2b5da2be954c470e61fa440fc78365d3276772edfb720cc
Instruction ID: 9e6034934ce757030edd9aae56db70867411f4ddc2b5c78e8bdce6f7ff98a1e3
Opcode Fuzzy Hash: 3e73f91e635fbd67d2b5da2be954c470e61fa440fc78365d3276772edfb720cc
Instruction Fuzzy Hash: D9616971108341AFC705EF65CC89DAFBBEAFBC9350F40492DF599921A1DB309A49CB62

Function 00663FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0067CC08), ref: 006640BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 006640CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,0067CC08), ref: 006640F2
FreeLibrary.KERNEL32(00000000,?,0067CC08), ref: 0066413E
StringFromGUID2.OLE32(?,?,00000028,?,0067CC08), ref: 006641A8
SysFreeString.OLEAUT32(00000009), ref: 00664262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 006642C8
SysFreeString.OLEAUT32(?), ref: 006642F2

Strings

GetModuleHandleExW, xrefs: 006640C7
kernel32.dll, xrefs: 006640B6

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 3517947a0618c6c241eaec0042757e31e9bf78694ee61aab3d412f8adcff4183
Instruction ID: 6f45a9ff40c3789a90b9ab4cda2dbdc5662bfd1b83e5ec418bc7f4ce96aad225
Opcode Fuzzy Hash: 3517947a0618c6c241eaec0042757e31e9bf78694ee61aab3d412f8adcff4183
Instruction Fuzzy Hash: DB123075A00115EFDB14DF54C884EAEBBB6FF85714F248098F909AB251DB31ED46CBA0

Function 005E326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(006B1990), ref: 00622F8D
GetMenuItemCount.USER32(006B1990), ref: 0062303D
GetCursorPos.USER32(?), ref: 00623081
SetForegroundWindow.USER32(00000000), ref: 0062308A
TrackPopupMenuEx.USER32(006B1990,00000000,?,00000000,00000000,00000000), ref: 0062309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 006230A9

Strings

0, xrefs: 005E327D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 023091ea172720fd2fe3fb8e755598fe88e735b5c685d6cf3ea226b09be3db7c
Instruction ID: 38dc6478e4f7253fa82a87f5d26881805266a9875ffd686d2bcd24862ea92b56
Opcode Fuzzy Hash: 023091ea172720fd2fe3fb8e755598fe88e735b5c685d6cf3ea226b09be3db7c
Instruction Fuzzy Hash: DE713A70640626BEFB258F25DD99FDABF76FF01324F204206F6546A2E0C7B1A950DB50

Function 00676CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00676DEB

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00676E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00676E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00676E94
DestroyWindow.USER32(?), ref: 00676EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,005E0000,00000000), ref: 00676EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00676EFD
GetDesktopWindow.USER32 ref: 00676F16
GetWindowRect.USER32(00000000), ref: 00676F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00676F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00676F4D

Part of subcall function 005F9944: GetWindowLongW.USER32(?,000000EB), ref: 005F9952

Strings

0, xrefs: 00676D98
tooltips_class32, xrefs: 00676E58, 00676EDD

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 245935628e409a6afbefc8d2c36b40eaac83b19c035ded2987866fa76cfd7e61
Instruction ID: 7c55b6a44b0c7c84a8650f82198ddf9931cd84af53b23d9e3d553f9ac1ef931b
Opcode Fuzzy Hash: 245935628e409a6afbefc8d2c36b40eaac83b19c035ded2987866fa76cfd7e61
Instruction Fuzzy Hash: E9718A70104640AFDB25EF18DC58FAABBFAFB89304F54851DF98987261C774A989CB11

Function 0065C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0065C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0065C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0065C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0065C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0065C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0065C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0065C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0065C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0065C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0065C5F0
InternetCloseHandle.WININET(00000000), ref: 0065C5FB

Strings

, xrefs: 0065C575

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 629534d1b95b11813635667c9b5ec28317365c519b3f8377e9db8480df38013a
Instruction ID: 9817310e9c2aee565d80775e57feeb4cc45dce7bcc9cf4440c24f314aa1f4192
Opcode Fuzzy Hash: 629534d1b95b11813635667c9b5ec28317365c519b3f8377e9db8480df38013a
Instruction Fuzzy Hash: EE5150B1500304BFDB258FA4C988AAB7BFEFF04765F10441DF94596250EB34EA58DB60

Function 0067856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00678592
GetFileSize.KERNEL32(00000000,00000000), ref: 006785A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 006785AD
CloseHandle.KERNEL32(00000000), ref: 006785BA
GlobalLock.KERNEL32(00000000), ref: 006785C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 006785D7
GlobalUnlock.KERNEL32(00000000), ref: 006785E0
CloseHandle.KERNEL32(00000000), ref: 006785E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 006785F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,0067FC38,?), ref: 00678611
GlobalFree.KERNEL32(00000000), ref: 00678621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00678641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00678671
DeleteObject.GDI32(00000000), ref: 00678699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 006786AF

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: fb559fc752cb96ba68bf5e72018152538798ccf66166e71475f83ded9192ad15
Instruction ID: b47e6bb1103af6dbc22238700f03d3e693db4853ae6603c3b469b281227f0958
Opcode Fuzzy Hash: fb559fc752cb96ba68bf5e72018152538798ccf66166e71475f83ded9192ad15
Instruction Fuzzy Hash: 3B413C75640204BFDB159FA5CC4CEAA7BBAFF89721F108158F919E7261DB309D41CB60

Function 006514BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00651502
VariantCopy.OLEAUT32(?,?), ref: 0065150B
VariantClear.OLEAUT32(?), ref: 00651517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 006515FB
VarR8FromDec.OLEAUT32(?,?), ref: 00651657
VariantInit.OLEAUT32(?), ref: 00651708
SysFreeString.OLEAUT32(?), ref: 0065178C
VariantClear.OLEAUT32(?), ref: 006517D8
VariantClear.OLEAUT32(?), ref: 006517E7
VariantInit.OLEAUT32(00000000), ref: 00651823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00651625
Default, xrefs: 006516AF

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 6ef2b21bed15191aed3ff4c45bd75f21d02997ee817454238ffa3ef1a8ea5f5c
Instruction ID: 3a9e148cc9cb6f909933e03b74c2e4b629985bf3608fd7e0265a65c6bd31c099
Opcode Fuzzy Hash: 6ef2b21bed15191aed3ff4c45bd75f21d02997ee817454238ffa3ef1a8ea5f5c
Instruction Fuzzy Hash: 4CD128B1600105DBDB14AF65D849BBDBBB6BF86701F108059FC46AF280EB34DD4ADB51

Function 0066B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 0066C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0066B6AE,?,?), ref: 0066C9B5
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066C9F1
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA68
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0066B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0066B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0066B80A
RegCloseKey.ADVAPI32(?), ref: 0066B87E
RegCloseKey.ADVAPI32(?), ref: 0066B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0066B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0066B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0066B922
FreeLibrary.KERNEL32(00000000), ref: 0066B983
RegCloseKey.ADVAPI32(00000000), ref: 0066B994

Strings

advapi32.dll, xrefs: 0066B8ED
RegDeleteKeyExW, xrefs: 0066B8FE

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 684b7407cff249bc3bc0679306b1475d3ddca171c6aa5d7e156556331a119482
Instruction ID: aba0e0491a9c0776e95c3e2f19410bee4c0144f392b27eedf81a2efeb382bfc8
Opcode Fuzzy Hash: 684b7407cff249bc3bc0679306b1475d3ddca171c6aa5d7e156556331a119482
Instruction Fuzzy Hash: 6AC18F30204242EFD714DF15C494F6ABBE6BF85318F14955CE49A8B3A2CB71EC86CB91

Function 0066255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 006625D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 006625E8
CreateCompatibleDC.GDI32(?), ref: 006625F4
SelectObject.GDI32(00000000,?), ref: 00662601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0066266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 006626AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 006626D0
SelectObject.GDI32(?,?), ref: 006626D8
DeleteObject.GDI32(?), ref: 006626E1
DeleteDC.GDI32(?), ref: 006626E8
ReleaseDC.USER32(00000000,?), ref: 006626F3

Strings

(, xrefs: 0066268D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 6192f6c8077f104a87f381f12459f768189e3b6950b47804802e8d9640fb04cb
Instruction ID: a11026b59e908fb344832a0896d0791e4375e350877fb6a5a8c8750cb28d2f38
Opcode Fuzzy Hash: 6192f6c8077f104a87f381f12459f768189e3b6950b47804802e8d9640fb04cb
Instruction Fuzzy Hash: 1561E2B5D0021AEFCF14CFA4D894AAEBBB6FF48310F20852DE959A7250D771A941CF94

Function 0061DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0061DAA1

Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D659
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D66B
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D67D
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D68F
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D6A1
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D6B3
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D6C5
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D6D7
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D6E9
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D6FB
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D70D
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D71F
Part of subcall function 0061D63C: _free.LIBCMT ref: 0061D731

_free.LIBCMT ref: 0061DA96

Part of subcall function 006129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000), ref: 006129DE
Part of subcall function 006129C8: GetLastError.KERNEL32(00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000,00000000), ref: 006129F0

_free.LIBCMT ref: 0061DAB8
_free.LIBCMT ref: 0061DACD
_free.LIBCMT ref: 0061DAD8
_free.LIBCMT ref: 0061DAFA
_free.LIBCMT ref: 0061DB0D
_free.LIBCMT ref: 0061DB1B
_free.LIBCMT ref: 0061DB26
_free.LIBCMT ref: 0061DB5E
_free.LIBCMT ref: 0061DB65
_free.LIBCMT ref: 0061DB82
_free.LIBCMT ref: 0061DB9A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: f90e62ad7e2ab8d377d6bd82df014e72370ed8b50d7453681b509b7c2fbc282c
Instruction ID: 86c119aab1f77d606a60756140180a90309a845fde373565579dc66cddd5ade9
Opcode Fuzzy Hash: f90e62ad7e2ab8d377d6bd82df014e72370ed8b50d7453681b509b7c2fbc282c
Instruction Fuzzy Hash: E6313F726047069FDB61AA39E845BDA77EAFF00720F19481DE449DB291DF35ACE08724

Function 0064365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0064369C
_wcslen.LIBCMT ref: 006436A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00643797
GetClassNameW.USER32(?,?,00000400), ref: 0064380C
GetDlgCtrlID.USER32(?), ref: 0064385D
GetWindowRect.USER32(?,?), ref: 00643882
GetParent.USER32(?), ref: 006438A0
ScreenToClient.USER32(00000000), ref: 006438A7
GetClassNameW.USER32(?,?,00000100), ref: 00643921
GetWindowTextW.USER32(?,?,00000400), ref: 0064395D

Strings

%s%u, xrefs: 00643734

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: f3214ae883cce7acd9723562e0623346c9f3d3fba60ae95200e4439dbe1c02f1
Instruction ID: 91f4a37ba24c35116e21b0a2a1650cf150ae2d68cd1e21b8e6f0f22fa859b695
Opcode Fuzzy Hash: f3214ae883cce7acd9723562e0623346c9f3d3fba60ae95200e4439dbe1c02f1
Instruction Fuzzy Hash: F691B271204616AFD719DF24C885FEAF7AAFF44350F10852DF999C6290EB30EA45CB91

Function 00644954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00644994
GetWindowTextW.USER32(?,?,00000400), ref: 006449DA
_wcslen.LIBCMT ref: 006449EB
CharUpperBuffW.USER32(?,00000000), ref: 006449F7
_wcsstr.LIBVCRUNTIME ref: 00644A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00644A64
GetWindowTextW.USER32(?,?,00000400), ref: 00644A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00644AE6
GetClassNameW.USER32(?,?,00000400), ref: 00644B20
GetWindowRect.USER32(?,?), ref: 00644B8B

Strings

ThumbnailClass, xrefs: 00644A6F, 00644AF1

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 4a4e8a1367fc8c59ecee36bcdf4f4b4078979872e0490551aaa92b9d50ce6d58
Instruction ID: e3534a71d44976d2a345706c74e523b56b4f126684a28707d38abc65fd899b9d
Opcode Fuzzy Hash: 4a4e8a1367fc8c59ecee36bcdf4f4b4078979872e0490551aaa92b9d50ce6d58
Instruction Fuzzy Hash: 7291AD710082059FDB08DF14C986BAA77EAFF84714F04846DFD899A296DF30ED85CBA1

Function 0064BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(006B1990,000000FF,00000000,00000030), ref: 0064BFAC
SetMenuItemInfoW.USER32(006B1990,00000004,00000000,00000030), ref: 0064BFE1
Sleep.KERNEL32(000001F4), ref: 0064BFF3
GetMenuItemCount.USER32(?), ref: 0064C039
GetMenuItemID.USER32(?,00000000), ref: 0064C056
GetMenuItemID.USER32(?,-00000001), ref: 0064C082
GetMenuItemID.USER32(?,?), ref: 0064C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0064C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0064C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0064C145

Strings

0, xrefs: 0064BF3D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 25ce32d374decb11bb02d618d72652fff3a00cab06014fe13d7df2a0f5639600
Instruction ID: 88d8dfa89994f225f223cce6a855ac6d0d85f79ef276ec2efd34827157b2249d
Opcode Fuzzy Hash: 25ce32d374decb11bb02d618d72652fff3a00cab06014fe13d7df2a0f5639600
Instruction Fuzzy Hash: 6A619EB090124AEFEF55CF64CC88AEE7BBAFB05364F100159E815A7391D732AD55CB60

Function 0066CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0066CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0066CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0066CD48

Part of subcall function 0066CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0066CCAA
Part of subcall function 0066CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0066CCBD
Part of subcall function 0066CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0066CCCF
Part of subcall function 0066CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0066CD05
Part of subcall function 0066CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0066CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0066CCF3

Strings

advapi32.dll, xrefs: 0066CCB8
RegDeleteKeyExW, xrefs: 0066CCC9

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 89a47909277392937349f367952b1964fd04946b33471dde501eafdb5dd9b0ec
Instruction ID: c216350a7d66bd056fd7b45ddf500bd636bab64ea5bcc9b5d9c5869833cb2561
Opcode Fuzzy Hash: 89a47909277392937349f367952b1964fd04946b33471dde501eafdb5dd9b0ec
Instruction Fuzzy Hash: 85318171901128BBD7209B54DC88EFFBB7EEF45760F000169F949E2240D7349E85DAE0

Function 00653D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00653D40
_wcslen.LIBCMT ref: 00653D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00653D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00653DBE
RemoveDirectoryW.KERNEL32(?), ref: 00653DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00653E55
CloseHandle.KERNEL32(00000000), ref: 00653E60
CloseHandle.KERNEL32(00000000), ref: 00653E6B

Strings

\??\%s, xrefs: 00653D5B
\, xrefs: 00653D77
:, xrefs: 00653D82

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: cd67f9df3728a5e38ef58a0a15e97a990a3269ee252be0809943c99a933ee9dc
Instruction ID: 9c673d7f4ca755dd3836cc6d3ce23237853032ff60d0462adbde46966808a52d
Opcode Fuzzy Hash: cd67f9df3728a5e38ef58a0a15e97a990a3269ee252be0809943c99a933ee9dc
Instruction Fuzzy Hash: 6831D672500119ABDB209FA0DC49FEF37BEEF88B51F1041B9FA19D6260E77097848B24

Function 0064E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0064E6B4

Part of subcall function 005FE551: timeGetTime.WINMM(?,?,0064E6D4), ref: 005FE555

Sleep.KERNEL32(0000000A), ref: 0064E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0064E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0064E727
SetActiveWindow.USER32 ref: 0064E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0064E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0064E773
Sleep.KERNEL32(000000FA), ref: 0064E77E
IsWindow.USER32 ref: 0064E78A
EndDialog.USER32(00000000), ref: 0064E79B

Strings

BUTTON, xrefs: 0064E719

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 35246d210720c9409f24a4778547ec989f2d3cf56de0793ad650eca403c54b08
Instruction ID: 1789c01156e39bf13a6e396c48aca89fe34d9f61adf27bd23022627455ac05c4
Opcode Fuzzy Hash: 35246d210720c9409f24a4778547ec989f2d3cf56de0793ad650eca403c54b08
Instruction Fuzzy Hash: 352196B0640205AFEB045F20ECDAE253BABF755369F103529F505812B1EB729CC0DB24

Function 0064E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0064EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0064EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0064EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0064EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0064EAA7

Strings

open , xrefs: 0064EA0C
play PlayMe, xrefs: 0064EAA2
alias PlayMe, xrefs: 0064EA36
play PlayMe wait, xrefs: 0064EA91
close PlayMe, xrefs: 0064EA6E, 0064EA9B
status PlayMe mode, xrefs: 0064EA58

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 6475dcf1470fc0a88aff43aa9df5c403e134152a9a37204ec0a8bc7f31e48658
Instruction ID: 6268aef781ba660370e5cdda613be719a6a18f3793a2df81d6d1f2d50e5b907e
Opcode Fuzzy Hash: 6475dcf1470fc0a88aff43aa9df5c403e134152a9a37204ec0a8bc7f31e48658
Instruction Fuzzy Hash: B1115E31A9025A79D724B7A2DC4EDFF6A7EFBD2B40F550429B811A20D1EEB04D85C9B0

Function 00645CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00645CE2
GetWindowRect.USER32(00000000,?), ref: 00645CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00645D59
GetDlgItem.USER32(?,00000002), ref: 00645D69
GetWindowRect.USER32(00000000,?), ref: 00645D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00645DCF
GetDlgItem.USER32(?,000003E9), ref: 00645DDD
GetWindowRect.USER32(00000000,?), ref: 00645DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00645E31
GetDlgItem.USER32(?,000003EA), ref: 00645E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00645E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00645E67

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 6b3bb2a55c11e0a872a8b7cdc686ec204a9e43d689fdcb4e4368a37a8c9480af
Instruction ID: b55079734d5b5e1f2345cf6fe245485fdb456c90c72fb7d00e25bf0945c8210c
Opcode Fuzzy Hash: 6b3bb2a55c11e0a872a8b7cdc686ec204a9e43d689fdcb4e4368a37a8c9480af
Instruction Fuzzy Hash: A9512D70A00615AFDB18CF68CD99AAEBBB6FF48310F149129F51AE6291D7709E40CB50

Function 005F8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 005F8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,005F8BE8,?,00000000,?,?,?,?,005F8BBA,00000000,?), ref: 005F8FC5

DestroyWindow.USER32(?), ref: 005F8C81
KillTimer.USER32(00000000,?,?,?,?,005F8BBA,00000000,?), ref: 005F8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00636973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,005F8BBA,00000000,?), ref: 006369A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,005F8BBA,00000000,?), ref: 006369B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,005F8BBA,00000000), ref: 006369D4
DeleteObject.GDI32(00000000), ref: 006369E6

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 5246060e4c935c230f5034831dee33f33d141ddf3d7da4feacdaf6cc5ee7b1a1
Instruction ID: 192193a75532dbe953938a6f28008ed9562a10c2cc04b434c94f66eb5be94d5f
Opcode Fuzzy Hash: 5246060e4c935c230f5034831dee33f33d141ddf3d7da4feacdaf6cc5ee7b1a1
Instruction Fuzzy Hash: CB61BA70002619EFCB259F14C968B757BF2FB41312F50AA1DE2469E6A0CB39ADD0CF90

Function 005F9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 005F9944: GetWindowLongW.USER32(?,000000EB), ref: 005F9952

GetSysColor.USER32(0000000F), ref: 005F9862

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: a40c1686f3bff53d8a4de0c4bc5663ec17e8635384121949cf4fdf3a9f8d3c23
Instruction ID: d47c4d1761f39f3ab2482a927208fe90a2a32856ef66e1269012669ae410a32e
Opcode Fuzzy Hash: a40c1686f3bff53d8a4de0c4bc5663ec17e8635384121949cf4fdf3a9f8d3c23
Instruction Fuzzy Hash: 7E41F671100A48AFDB345F389C88BB93FA6FB56370F144619FAA6872E1C7359C81DB50

Function 00618D45 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Strings

.`, xrefs: 0061903A, 00618FD0, 00618FF2

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID: .`
API String ID: 0-3826532246
Opcode ID: 11ddbb78b1473920c2fb8486d0348df66e500886466c858ad54c872ddd28f62c
Instruction ID: e148ee2720a18e2b7d4d29fbc2dd3586cb686c5588e789fe9b829428ca2690df
Opcode Fuzzy Hash: 11ddbb78b1473920c2fb8486d0348df66e500886466c858ad54c872ddd28f62c
Instruction Fuzzy Hash: 64C1C374E042499FDB25DFA8D851BEEBBB6AF09310F1C419DE814A7392C7309982CB65

Function 006496E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0062F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00649717
LoadStringW.USER32(00000000,?,0062F7F8,00000001), ref: 00649720

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0062F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00649742
LoadStringW.USER32(00000000,?,0062F7F8,00000001), ref: 00649745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00649866

Strings

Line %d:, xrefs: 006497A0
Error: , xrefs: 0064981D
%s (%d) : ==> %s: %s %s, xrefs: 0064984A
^ ERROR, xrefs: 006497FB
Line %d (File "%s"):, xrefs: 0064978F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: eaa73cf0a331c8f28b0da060b16dce829dfa65eb5811274529d4a8209b41a4cf
Instruction ID: c9d74f2242dd0f3f989212e0e89633dd91b4a7cfb4670153d2e0afaf4b624194
Opcode Fuzzy Hash: eaa73cf0a331c8f28b0da060b16dce829dfa65eb5811274529d4a8209b41a4cf
Instruction Fuzzy Hash: 8341507280414AAACB18FBE1CD4ADEE7B7ABF95340F600465B50572092EA356F49CB71

Function 006406DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 006407A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 006407BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 006407DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00640804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0064082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00640837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0064083C

Strings

SOFTWARE\Classes\, xrefs: 0064070E
\IPC$, xrefs: 00640784
\CLSID, xrefs: 00640724

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 8187833e31a49dd52155ff2583f41317d835d7063e5f7930d080c3852cc7dfbd
Instruction ID: 4f803ed666cffd600ee34fab557029eecd33b457d4ed0cedab79bce8d089fa3e
Opcode Fuzzy Hash: 8187833e31a49dd52155ff2583f41317d835d7063e5f7930d080c3852cc7dfbd
Instruction Fuzzy Hash: 9A413B72C00269ABDF19EBA4DC99CEDBB79BF84350F154129E945A3161EB306E44CBA0

Function 00663C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00663C5C
CoInitialize.OLE32(00000000), ref: 00663C8A
CoUninitialize.OLE32 ref: 00663C94
_wcslen.LIBCMT ref: 00663D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00663DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00663ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00663F0E
CoGetObject.OLE32(?,00000000,0067FB98,?), ref: 00663F2D
SetErrorMode.KERNEL32(00000000), ref: 00663F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00663FC4
VariantClear.OLEAUT32(?), ref: 00663FD8

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 2ad0fe8181c1b8543dd78b00bbadbb7673c95c1a53fa99ff9b6e36cf9a447598
Instruction ID: 0fa6a06d6cd6d02e54ea0a7eb2e3a17450dd28ceca730d3e51afb4e1641e340e
Opcode Fuzzy Hash: 2ad0fe8181c1b8543dd78b00bbadbb7673c95c1a53fa99ff9b6e36cf9a447598
Instruction Fuzzy Hash: ADC13171608215AFD700DF68C88496BBBEAFF89744F00491DF98A9B351DB31EE46CB52

Function 00657A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00657AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00657B8F
SHGetDesktopFolder.SHELL32(?), ref: 00657BA3
CoCreateInstance.OLE32(0067FD08,00000000,00000001,006A6E6C,?), ref: 00657BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00657C74
CoTaskMemFree.OLE32(?,?), ref: 00657CCC
SHBrowseForFolderW.SHELL32(?), ref: 00657D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00657D7A
CoTaskMemFree.OLE32(00000000), ref: 00657D81
CoTaskMemFree.OLE32(00000000), ref: 00657DD6
CoUninitialize.OLE32 ref: 00657DDC

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 6cc2a7e1fd84c609ee1d7f41fdf1283bbf7dcc7873cec6b35488dcc50f72e21e
Instruction ID: 2089db3a3fece5ecf82d9124290a52138f20e45c4e38f991afc44a9969a54a5c
Opcode Fuzzy Hash: 6cc2a7e1fd84c609ee1d7f41fdf1283bbf7dcc7873cec6b35488dcc50f72e21e
Instruction Fuzzy Hash: 7CC14C75A04109AFCB14DF64D888DAEBBFAFF48315F148199E8199B361D730ED45CB90

Function 0067541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00675504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00675515
CharNextW.USER32(00000158), ref: 00675544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00675585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0067559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006755AC

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 44c9bb5a1aeb4f107d1a90ca32fda8fc30537a9ba62a55aafff1db1850f59dcf
Instruction ID: e15e6badf43437076cd5b3375523c1f06052e9833993b38fcc7d1b2189442c9b
Opcode Fuzzy Hash: 44c9bb5a1aeb4f107d1a90ca32fda8fc30537a9ba62a55aafff1db1850f59dcf
Instruction Fuzzy Hash: 4A617070904609EFDF10DF54CC859FE7BBBEB05760F108189F62AAA290D7B49A81DB61

Function 0063FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0063FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0063FB08
VariantInit.OLEAUT32(?), ref: 0063FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0063FB3A
VariantCopy.OLEAUT32(?,?), ref: 0063FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0063FBA1
VariantClear.OLEAUT32(?), ref: 0063FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0063FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0063FBCC
VariantClear.OLEAUT32(?), ref: 0063FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0063FBE9

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: b52939a8411bf4a32ffe0c3eb4e9222aaa2446fc3e0be0520841ed0f4d240709
Instruction ID: 3c8a475c0fb25317d8891f6d7f59f6867a0a75ad60a350f4ba8aeb386bb425c3
Opcode Fuzzy Hash: b52939a8411bf4a32ffe0c3eb4e9222aaa2446fc3e0be0520841ed0f4d240709
Instruction Fuzzy Hash: 9E415F75E00219DFCB04DF64D858DEEBBBAFF48354F009069E95AA7261DB30A985CB90

Function 00649C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00649CA1
GetAsyncKeyState.USER32(000000A0), ref: 00649D22
GetKeyState.USER32(000000A0), ref: 00649D3D
GetAsyncKeyState.USER32(000000A1), ref: 00649D57
GetKeyState.USER32(000000A1), ref: 00649D6C
GetAsyncKeyState.USER32(00000011), ref: 00649D84
GetKeyState.USER32(00000011), ref: 00649D96
GetAsyncKeyState.USER32(00000012), ref: 00649DAE
GetKeyState.USER32(00000012), ref: 00649DC0
GetAsyncKeyState.USER32(0000005B), ref: 00649DD8
GetKeyState.USER32(0000005B), ref: 00649DEA

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 054d83d3da1d8c68bfdd8ebc9a29aa380caff9bba040af3d586eecf03f878776
Instruction ID: 720f07d48e0e6b207517650c572ebdcc993858d86a5cafcf5cd4cd073c45d042
Opcode Fuzzy Hash: 054d83d3da1d8c68bfdd8ebc9a29aa380caff9bba040af3d586eecf03f878776
Instruction Fuzzy Hash: E541E830984BC96DFF348A6088443F7BEA36F12304F04805EC6C6563C2DBA599C4CBB2

Function 0066055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 006605BC
inet_addr.WSOCK32(?), ref: 0066061C
gethostbyname.WSOCK32(?), ref: 00660628
IcmpCreateFile.IPHLPAPI ref: 00660636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 006606C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 006606E5
IcmpCloseHandle.IPHLPAPI(?), ref: 006607B9
WSACleanup.WSOCK32 ref: 006607BF

Strings

Ping, xrefs: 00660676

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 542f450087e33e4bbca130ebfc4ab18398f85712777ce21bd48ea45aa375b8cd
Instruction ID: 725b7d7905d0aa3039ab16eaf8b65ca29c760e7037f6bf2ba4d16ea1f172c5d9
Opcode Fuzzy Hash: 542f450087e33e4bbca130ebfc4ab18398f85712777ce21bd48ea45aa375b8cd
Instruction Fuzzy Hash: DE917C35604241AFE324DF15D588F5ABFE2BF84318F1485A9E46A8B7A2C730ED85CF91

Function 00668CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00668CF3

Part of subcall function 00648E54: _wcslen.LIBCMT ref: 00648E77

_wcslen.LIBCMT ref: 00668D4E
_wcslen.LIBCMT ref: 00668D9C
_wcslen.LIBCMT ref: 00668DDC
_wcslen.LIBCMT ref: 00668E6E

Strings

none, xrefs: 00668E65, 00668E6A
cdecl, xrefs: 00668D48, 00668D4D
stdcall, xrefs: 00668DD6, 00668DDB
winapi, xrefs: 00668D96, 00668D9B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: fdb8d3fe881d6978c4a5b336febb6d99e63c9cf9053fbb586b26cb34b9b989f2
Instruction ID: 80a9d4eafde5fd8a98fbf920e7616d6aef509e1a1a15a3b95aa71a6e1790a79b
Opcode Fuzzy Hash: fdb8d3fe881d6978c4a5b336febb6d99e63c9cf9053fbb586b26cb34b9b989f2
Instruction Fuzzy Hash: 35518C72A041169FCB24DF78C9509FEB7A6BF65324B204329E966A73C4DB31DD408BA0

Function 0066372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00663774
CoUninitialize.OLE32 ref: 0066377F
CoCreateInstance.OLE32(?,00000000,00000017,0067FB78,?), ref: 006637D9
IIDFromString.OLE32(?,?), ref: 0066384C
VariantInit.OLEAUT32(?), ref: 006638E4
VariantClear.OLEAUT32(?), ref: 00663936

Strings

Invalid parameter, xrefs: 00663865
NULL Pointer assignment, xrefs: 0066381E
Failed to create object, xrefs: 006637E4, 0066389A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 34b5653c4fd54326994ed8a29b6d9a194549b16fe18cc61da69a994839a6bf99
Instruction ID: a73a9921e44b0a7762fffcab9cde26cf8caeefad0a026d96061d6c61ed4b33a3
Opcode Fuzzy Hash: 34b5653c4fd54326994ed8a29b6d9a194549b16fe18cc61da69a994839a6bf99
Instruction Fuzzy Hash: E761A070608321AFD310DF54C849BAABBEAEF89710F00090DF9859B391D770EE49CB96

Function 00653388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 006533CF

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 006533F0

Strings

Error: , xrefs: 006534D1
^ ERROR , xrefs: 0065349E
"%s" (%d) : ==> %s:, xrefs: 00653522
"%s" (%d) : ==> %s:%s%s, xrefs: 00653504
Incorrect parameters to object property !, xrefs: 006534AB
Line %d (File "%s"):, xrefs: 00653443, 0065345C

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 7235b1a334046641cf37ee943ab1d62a8fd55bb2a755ef459410214a2dd56e7a
Instruction ID: cbb2f04de186dc0df6490ec79642a2586ce03d201f238064a72a55e42eeb006f
Opcode Fuzzy Hash: 7235b1a334046641cf37ee943ab1d62a8fd55bb2a755ef459410214a2dd56e7a
Instruction Fuzzy Hash: DE51B37180014AAADF19EBA0CD4AEEEBBBAFF45740F244165F50572161EB312F98CF60

Function 0064B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0064B5FC
_wcslen.LIBCMT ref: 0064B608
_wcslen.LIBCMT ref: 0064B64D
_wcslen.LIBCMT ref: 0064B68C
_wcslen.LIBCMT ref: 0064B6C7

Strings

KEYS, xrefs: 0064B647, 0064B64C
APPEND, xrefs: 0064B6C1, 0064B6C6
REMOVE, xrefs: 0064B602, 0064B607
EXISTS, xrefs: 0064B686, 0064B68B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 4bf7c70b31ddbc9935ed239c266efa6c14018e5164037cfae7d62defac36fad1
Instruction ID: 9943be374e83f604c99ca196fe4899c4b48bbcea28adad7ceefce4ebd3fd76f4
Opcode Fuzzy Hash: 4bf7c70b31ddbc9935ed239c266efa6c14018e5164037cfae7d62defac36fad1
Instruction Fuzzy Hash: DF41D632A010279BCB20AF7DC8905FE7BA7BFA1754B265129E961DB384E731CD81C790

Function 00655393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006553A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00655416
GetLastError.KERNEL32 ref: 00655420
SetErrorMode.KERNEL32(00000000,READY), ref: 006554A7

Strings

NOTREADY, xrefs: 0065544B
READONLY, xrefs: 00655452
INVALID, xrefs: 00655459
READY, xrefs: 00655460, 00655468
UNKNOWN, xrefs: 00655444

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 2a715bb731e88bb79f8c51b85794c0c57ea493b026f1caf54156d87a63c98bc6
Instruction ID: 1201c476e611a578ce9b36ff1528161d746b20b44e2e58660d19e759b0938037
Opcode Fuzzy Hash: 2a715bb731e88bb79f8c51b85794c0c57ea493b026f1caf54156d87a63c98bc6
Instruction Fuzzy Hash: CD31B335A006459FD714DF68C898AE9BBF6FF45306F188069E806CB392D731DD8ACB90

Function 00673C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00673C79
SetMenu.USER32(?,00000000), ref: 00673C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00673D10
IsMenu.USER32(?), ref: 00673D24
CreatePopupMenu.USER32 ref: 00673D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00673D5B
DrawMenuBar.USER32 ref: 00673D63

Strings

F, xrefs: 00673D4E
0, xrefs: 00673C54

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 405f21cbca96f09f67e2f54564717628b614aeccacc7f8669d25306685352115
Instruction ID: 0e8f7fdc95edf26eec8b3ecff8626954a576a65f45fdfae784a02e76f6557e42
Opcode Fuzzy Hash: 405f21cbca96f09f67e2f54564717628b614aeccacc7f8669d25306685352115
Instruction Fuzzy Hash: 3C419A74A01219EFDB28CF64D854AEA7BB6FF49310F14402CF94AA7360D771AA10DF90

Function 00641EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 00643CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00643CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00641F64
GetDlgCtrlID.USER32 ref: 00641F6F
GetParent.USER32 ref: 00641F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00641F8E
GetDlgCtrlID.USER32(?), ref: 00641F97
GetParent.USER32(?), ref: 00641FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00641FAE

Strings

ListBox, xrefs: 00641F21
ComboBox, xrefs: 00641EEC

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 3d21812298eb40e49def2c75d82dbe940f1d7954ce6f480d9921603c958fc651
Instruction ID: 439ffb3fc90a5a5e85cfafd39ff7f8860c243c48796760d09ef8e39518543c06
Opcode Fuzzy Hash: 3d21812298eb40e49def2c75d82dbe940f1d7954ce6f480d9921603c958fc651
Instruction Fuzzy Hash: F521D170900214BBCF08AFA0CC85EEEBBBAEF06310F100159F965A72A1DB355989DB60

Function 00673A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00673A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00673AA0
GetWindowLongW.USER32(?,000000F0), ref: 00673AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00673AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00673B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00673BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00673BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00673BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00673BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00673C13

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 5fa013c3a0d7fb167a09ec1d6ea426e888b18b5443b2fc43fff15d5a3a97ce81
Instruction ID: 23ee6755b3b31fb594e4d7413c32dfd7c1e5ff08a22df2a020a9bc2ca4dd99e6
Opcode Fuzzy Hash: 5fa013c3a0d7fb167a09ec1d6ea426e888b18b5443b2fc43fff15d5a3a97ce81
Instruction Fuzzy Hash: FD616CB5900258AFDB11DF68CC81EEE77B9EB09710F104199FA19AB391D770AE81DF50

Function 00612C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00612C94

Part of subcall function 006129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000), ref: 006129DE
Part of subcall function 006129C8: GetLastError.KERNEL32(00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000,00000000), ref: 006129F0

_free.LIBCMT ref: 00612CA0
_free.LIBCMT ref: 00612CAB
_free.LIBCMT ref: 00612CB6
_free.LIBCMT ref: 00612CC1
_free.LIBCMT ref: 00612CCC
_free.LIBCMT ref: 00612CD7
_free.LIBCMT ref: 00612CE2
_free.LIBCMT ref: 00612CED
_free.LIBCMT ref: 00612CFB

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d730da81bd45cf07be6670168b57077f32aefe72bf61ca66d9cb41ce16f66cb2
Instruction ID: 190b2032d830512401e0dd5d9d85a80bfcc0d76b748cd059a187064eeec57530
Opcode Fuzzy Hash: d730da81bd45cf07be6670168b57077f32aefe72bf61ca66d9cb41ce16f66cb2
Instruction Fuzzy Hash: 3211E976100109BFCB42EF59D852CDD3BA6FF05760F4548A8FA485F222D631EEB09B94

Function 005E1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 005E1459
OleUninitialize.OLE32(?,00000000), ref: 005E14F8
UnregisterHotKey.USER32(?), ref: 005E16DD
DestroyWindow.USER32(?), ref: 006224B9
FreeLibrary.KERNEL32(?), ref: 0062251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0062254B

Strings

close all, xrefs: 005E1454

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 3987e2af8df8532447ab311a0cb4adbc0583015abb8c6c7370e63cf96c214425
Instruction ID: 364afff17c668e7384697e85576a6739c58bb5b8dd717a36aa8aa8252a3bf04b
Opcode Fuzzy Hash: 3987e2af8df8532447ab311a0cb4adbc0583015abb8c6c7370e63cf96c214425
Instruction Fuzzy Hash: EDD1AD31701663DFCB29EF15D4A8A69FBA2BF44700F1481ADE58AAB351CB30AD52CF54

Function 00657DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00657FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00657FC1
GetFileAttributesW.KERNEL32(?), ref: 00657FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00658005
SetCurrentDirectoryW.KERNEL32(?), ref: 00658017
SetCurrentDirectoryW.KERNEL32(?), ref: 00658060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 006580B0

Strings

*.*, xrefs: 00658066

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 549fed2ee03d8f1132f10d7d55ac20e34f3d897dfa3fa216fbb073523334b797
Instruction ID: c84cd9625253fc7a4774ae6fbf8290a4b6d95540605449965b11654214b36d69
Opcode Fuzzy Hash: 549fed2ee03d8f1132f10d7d55ac20e34f3d897dfa3fa216fbb073523334b797
Instruction Fuzzy Hash: 5881CF725083459FCB24EF14D8469AAB7EABF88312F14486EFC85D7250EB34DD49CB92

Function 005E5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 005E5C7A

Part of subcall function 005E5D0A: GetClientRect.USER32(?,?), ref: 005E5D30
Part of subcall function 005E5D0A: GetWindowRect.USER32(?,?), ref: 005E5D71
Part of subcall function 005E5D0A: ScreenToClient.USER32(?,?), ref: 005E5D99

GetDC.USER32 ref: 006246F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00624708
SelectObject.GDI32(00000000,00000000), ref: 00624716
SelectObject.GDI32(00000000,00000000), ref: 0062472B
ReleaseDC.USER32(?,00000000), ref: 00624733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 006247C4

Strings

U, xrefs: 00624693

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 18ec98b1fe719cae54d68bd16ee29b352ba166800bd7475c24f34d5908615d0a
Instruction ID: ad652d12f1d5ce589c4fc16bb4186396260c3368635a2eddefcd2ddef961b3db
Opcode Fuzzy Hash: 18ec98b1fe719cae54d68bd16ee29b352ba166800bd7475c24f34d5908615d0a
Instruction Fuzzy Hash: FB710231500A05DFCF258F64D984AFA3BB7FF4A324F244269EDA95A266DB318C81DF50

Function 0065359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 006535E4

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

LoadStringW.USER32(006B2390,?,00000FFF,?), ref: 0065360A

Strings

Error: , xrefs: 006536EF
"%s" (%d) : ==> %s:, xrefs: 00653742
"%s" (%d) : ==> %s:%s%s, xrefs: 00653724
^ ERROR, xrefs: 006536C9
Line %d (File "%s"):, xrefs: 0065366B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: b5880a0a520d4b3a78a1a7ecb1fe632dc805cd122606c0e1a784d9a1544241aa
Instruction ID: 16ee8ac055c1d3aada1eed0dde4ff8a55c11e916da2e789b59e050947e1c8716
Opcode Fuzzy Hash: b5880a0a520d4b3a78a1a7ecb1fe632dc805cd122606c0e1a784d9a1544241aa
Instruction Fuzzy Hash: 2251AF71C0025ABACF19EBA1CC46EEEBB7AFF48741F144129F505721A1EB301A89CF60

Function 0065C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0065C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0065C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0065C2CA
GetLastError.KERNEL32 ref: 0065C322
SetEvent.KERNEL32(?), ref: 0065C336
InternetCloseHandle.WININET(00000000), ref: 0065C341

Strings

, xrefs: 0065C2BB

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: c1f80c72358af9b17f22c4e2ca0c626332e09a6c784d6c4b90baa552da27c192
Instruction ID: a12d65221e6d828a1e599427caee19dc67362560900d4efcceb907cdc568b98b
Opcode Fuzzy Hash: c1f80c72358af9b17f22c4e2ca0c626332e09a6c784d6c4b90baa552da27c192
Instruction Fuzzy Hash: C13181B1500308AFD7259F64CC88AAB7BFEEF49765F10851DF84AD2211DB30DD499B60

Function 0064989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00623AAF,?,?,Bad directive syntax error,0067CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 006498BC
LoadStringW.USER32(00000000,?,00623AAF,?), ref: 006498C3

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00649987

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 006498F1
., xrefs: 0064996D
Line %d:, xrefs: 00649912
Error: , xrefs: 00649955
Line %d (File "%s"):, xrefs: 0064992D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 22a8d5d33736e66b8d1bbc632e6f470c47df57adb1edd584aa62eb4299f321ff
Instruction ID: 2371681afe9f5cf1b14b924b9db78d79436d3f67dae89c94813de56be575f967
Opcode Fuzzy Hash: 22a8d5d33736e66b8d1bbc632e6f470c47df57adb1edd584aa62eb4299f321ff
Instruction Fuzzy Hash: BB21763184025EEBCF19AF90CC0AEEE7B76FF59300F084469F519660A1EB719A58DF60

Function 0064209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 006420AB
GetClassNameW.USER32(00000000,?,00000100), ref: 006420C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0064214D

Strings

details, xrefs: 006420FB
SHELLDLL_DefView, xrefs: 006420CC
list, xrefs: 0064212F
smallicons, xrefs: 00642115
largeicons, xrefs: 006420E1

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 68f7bd23b21d64b01aa3733b3214684590c5a73fe1bdd88cc03f017323de0eaf
Instruction ID: 809247a488acf84487acdb88c561c7306c94826a3a467dc68943b99d5a452b1e
Opcode Fuzzy Hash: 68f7bd23b21d64b01aa3733b3214684590c5a73fe1bdd88cc03f017323de0eaf
Instruction Fuzzy Hash: 08113A762C4307B9F7157224DC26DE7379FCB06725B71001AF705A60D1EE655C425A28

Function 0061CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0061CEB7
_free.LIBCMT ref: 0061CF22
_free.LIBCMT ref: 0061CF48
_free.LIBCMT ref: 0061CF71
_free.LIBCMT ref: 0061CFA9
_free.LIBCMT ref: 0061CFDA
_free.LIBCMT ref: 0061D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0061D09C
_free.LIBCMT ref: 0061D0B5

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 5ab18a008210119110416945c0861ede1520aba2cb9f10f0597cee0eee18fe79
Instruction ID: a211cf600d57d4c369516523d3ed228e5a5be57c86c7952690126b8fcfe7a60a
Opcode Fuzzy Hash: 5ab18a008210119110416945c0861ede1520aba2cb9f10f0597cee0eee18fe79
Instruction Fuzzy Hash: 416127B1944301AFDB21AFB89891AEE7BA7AF05730F0C416DF94497381D6319DC2C794

Function 006750D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00675186
ShowWindow.USER32(?,00000000), ref: 006751C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 006751CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 006751D1

Part of subcall function 00676FBA: DeleteObject.GDI32(00000000), ref: 00676FE6

GetWindowLongW.USER32(?,000000F0), ref: 0067520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0067521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0067524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00675287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00675296

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: c2aa56ba3afd57e8b2b11787d6bb2e22bf066a19fea5aca884434c5332b5bae8
Instruction ID: 15d28c59a9bdb742594ef0c1fdce85900a3ecafe35d399d232a068d3d97e38cd
Opcode Fuzzy Hash: c2aa56ba3afd57e8b2b11787d6bb2e22bf066a19fea5aca884434c5332b5bae8
Instruction Fuzzy Hash: 3851A430A50A09BEEF249F24CC49BD83B67FB05321F54C195F62E962E1C7F5AA90DB40

Function 005F8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00636890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 006368A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 006368B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 006368D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 006368F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,005F8874,00000000,00000000,00000000,000000FF,00000000), ref: 00636901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0063691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,005F8874,00000000,00000000,00000000,000000FF,00000000), ref: 0063692D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: fc48fa38c1b230b85ec61cff4e753e655c768114fc02674de68d1968af6061d4
Instruction ID: d02183a830b7712c2287304b0056b2dc2b2b11885106daf2b88fc1fa54376cea
Opcode Fuzzy Hash: fc48fa38c1b230b85ec61cff4e753e655c768114fc02674de68d1968af6061d4
Instruction Fuzzy Hash: 0F519A70600609FFDB24CF25CC95BBA7BB6FB48360F104518FA56972A0DB74E990DB50

Function 0065C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0065C182
GetLastError.KERNEL32 ref: 0065C195
SetEvent.KERNEL32(?), ref: 0065C1A9

Part of subcall function 0065C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0065C272
Part of subcall function 0065C253: GetLastError.KERNEL32 ref: 0065C322
Part of subcall function 0065C253: SetEvent.KERNEL32(?), ref: 0065C336
Part of subcall function 0065C253: InternetCloseHandle.WININET(00000000), ref: 0065C341

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: d3a3d1f9d6c75764ac591d73d65da573ec05dc4ce1f56d9bf10e58b18673e8e3
Instruction ID: 044a99d6c571981acbda733f5928b527658adf957606e089daefbf8369524df7
Opcode Fuzzy Hash: d3a3d1f9d6c75764ac591d73d65da573ec05dc4ce1f56d9bf10e58b18673e8e3
Instruction Fuzzy Hash: AF318F71200701AFDB259FA5DC44AA6BBFAFF58322F10441DFD5A86611DB30E958DBA0

Function 006425A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00643A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00643A57
Part of subcall function 00643A3D: GetCurrentThreadId.KERNEL32 ref: 00643A5E
Part of subcall function 00643A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006425B3), ref: 00643A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 006425BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 006425DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 006425DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 006425E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00642601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00642605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0064260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00642623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00642627

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: cbf9cfe559824737038b9347b04d00f80f3266c1fa0059b8c274d726a234e0c4
Instruction ID: 5c95818e10cb0eb59892352eb63eea1c61444d6cd9355e4414d86eef6a52bd0b
Opcode Fuzzy Hash: cbf9cfe559824737038b9347b04d00f80f3266c1fa0059b8c274d726a234e0c4
Instruction Fuzzy Hash: F801D430390220BBFB106768DC8AF593F5ADF4EB22F501019F318AE1D1C9E22484DA69

Function 00641803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00641449,?,?,00000000), ref: 0064180C
HeapAlloc.KERNEL32(00000000,?,00641449,?,?,00000000), ref: 00641813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00641449,?,?,00000000), ref: 00641828
GetCurrentProcess.KERNEL32(?,00000000,?,00641449,?,?,00000000), ref: 00641830
DuplicateHandle.KERNEL32(00000000,?,00641449,?,?,00000000), ref: 00641833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00641449,?,?,00000000), ref: 00641843
GetCurrentProcess.KERNEL32(00641449,00000000,?,00641449,?,?,00000000), ref: 0064184B
DuplicateHandle.KERNEL32(00000000,?,00641449,?,?,00000000), ref: 0064184E
CreateThread.KERNEL32(00000000,00000000,00641874,00000000,00000000,00000000), ref: 00641868

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 5750034d011bc347229dac8647cb6a0eb440969b0e89242088df4e380e514827
Instruction ID: 34c26757027763f79b40eb35ffb079cb63c6407abf20580f897f1e6b3157fdb7
Opcode Fuzzy Hash: 5750034d011bc347229dac8647cb6a0eb440969b0e89242088df4e380e514827
Instruction Fuzzy Hash: 3D01CDB5240308BFE710AFB5DC4DF6B3BADEB89B21F415425FA09DB1A1DA709840CB20

Function 00613E80 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00613F0B
__alldvrm.LIBCMT ref: 0061410C
__alldvrm.LIBCMT ref: 0061412E

Strings

}}`, xrefs: 00613E8A
}}`, xrefs: 00613E96, 00613EF1, 00613F0A, 00614090
}}`, xrefs: 006140CD

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID: }}`$}}`$}}`
API String ID: 1036877536-2075275272
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: fe2b549521159d5d3f02242a4381776987007b657943d55c7321b2e254422827
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: BFA15672D00296AFD715CF18C8927FABBE6EF26350F1C41ADE5859B381CA3489C2C750

Function 0066A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0064D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0064D501
Part of subcall function 0064D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0064D50F
Part of subcall function 0064D4DC: CloseHandle.KERNEL32(00000000), ref: 0064D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0066A16D
GetLastError.KERNEL32 ref: 0066A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0066A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0066A268
GetLastError.KERNEL32(00000000), ref: 0066A273
CloseHandle.KERNEL32(00000000), ref: 0066A2C4

Strings

SeDebugPrivilege, xrefs: 0066A18F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 79cc2b21a6175b51902876d4a1724e2d040900603cfa5d9d0ad1e6425d7b4461
Instruction ID: 81e1b9d3285d28dcf00df7b471c0ee29bce14baa4d92924d90e170df79ccd0ba
Opcode Fuzzy Hash: 79cc2b21a6175b51902876d4a1724e2d040900603cfa5d9d0ad1e6425d7b4461
Instruction Fuzzy Hash: D161BF302042429FD724DF59C494F56BBE6AF44318F18849CE46A9B7A3C772ED86CF92

Function 00673886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00673925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0067393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00673954
_wcslen.LIBCMT ref: 00673999
SendMessageW.USER32(?,00001057,00000000,?), ref: 006739C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 006739F4

Strings

SysListView32, xrefs: 006738F7

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 31580c2bdebb0311b2a18c7e5648bbaff2f62d9d0270c0031160bd668e1761ce
Instruction ID: b52dd5d61c549521825994efe80ba207884e87a5c433a368d6c56e76719cd72d
Opcode Fuzzy Hash: 31580c2bdebb0311b2a18c7e5648bbaff2f62d9d0270c0031160bd668e1761ce
Instruction Fuzzy Hash: E3417371A00219ABDB259F64CC49BEA7BAAFF08350F10452AF95CE7381D7719E80DB90

Function 0064BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0064BCFD
IsMenu.USER32(00000000), ref: 0064BD1D
CreatePopupMenu.USER32 ref: 0064BD53
GetMenuItemCount.USER32(013A5268), ref: 0064BDA4
InsertMenuItemW.USER32(013A5268,?,00000001,00000030), ref: 0064BDCC

Strings

2, xrefs: 0064BD37
0, xrefs: 0064BCA8

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 99fc17549482c20f4031697f9abf6f5e22ed5ac1012511eabb5d9dfb89b6a7c9
Instruction ID: 342b1bebae37a842a1261442b16dc1fa2f1841bbe187d1d06493a0070ab42e87
Opcode Fuzzy Hash: 99fc17549482c20f4031697f9abf6f5e22ed5ac1012511eabb5d9dfb89b6a7c9
Instruction Fuzzy Hash: 5051AD70A002059BDF24DFA8D8C4BEEBBF6AF45324F146299E41597390D770D945CB61

Function 00602D20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00602D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00602D53
_ValidateLocalCookies.LIBCMT ref: 00602DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00602E0C
_ValidateLocalCookies.LIBCMT ref: 00602E61

Strings

&H`, xrefs: 00602DFE, 00602E07, 00602E18
csm, xrefs: 00602DF6

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: &H`$csm
API String ID: 1170836740-2734105892
Opcode ID: 93379882103f2cb62462647bb450fb6515095f187306e46a83fdabf6d019ec11
Instruction ID: 9ff78f4be1828ff277893d368e02f59c741e112d93dc32b9ac7a16252d655b8d
Opcode Fuzzy Hash: 93379882103f2cb62462647bb450fb6515095f187306e46a83fdabf6d019ec11
Instruction Fuzzy Hash: D441B634A4021AABCF18DF68C869ADFBBB7BF45324F148159E8146B3D2D7719E05CB90

Function 0064C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0064C913

Strings

blank, xrefs: 0064C895
question, xrefs: 0064C8CC
warning, xrefs: 0064C8FC
info, xrefs: 0064C8B4
stop, xrefs: 0064C8E4

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 9f6e5556f56141923fbe38cc93988c19199a14e82e436c23577b916eea16166d
Instruction ID: 348795ae5eab9b948e2b5a30ffed1c10de81dbda955d2439b12f12c472f15013
Opcode Fuzzy Hash: 9f6e5556f56141923fbe38cc93988c19199a14e82e436c23577b916eea16166d
Instruction Fuzzy Hash: AE112B3278A306BEE7586B18DC83CEB2B9EDF15334B10002EF504A63C2EF749D405668

Function 0064DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0064DE42
gethostname.WSOCK32(?,00000100), ref: 0064DE5C
gethostbyname.WSOCK32(?), ref: 0064DE69
inet_ntoa.WSOCK32(?), ref: 0064DEAB
_strcat.LIBCMT ref: 0064DEB9
WSACleanup.WSOCK32 ref: 0064DEDE

Strings

0.0.0.0, xrefs: 0064DE87

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: c402dc06d94a39f58ff7f611dcc2b10f22297de3823f10214d43c6605bc46f3c
Instruction ID: ae22aaec943d976cfa8dd2d6839e40ddbd5825b8e531f7dd91cf16b3bf131ccf
Opcode Fuzzy Hash: c402dc06d94a39f58ff7f611dcc2b10f22297de3823f10214d43c6605bc46f3c
Instruction Fuzzy Hash: 3E110671904105AFCB68AB60DC4AEEF77AEDF11720F01016DF509AA1D1EFB18A818B60

Function 0064ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0064ED2A
_wcslen.LIBCMT ref: 0064ED3B
_wcslen.LIBCMT ref: 0064ED79
_wcslen.LIBCMT ref: 0064EDAF
_wcslen.LIBCMT ref: 0064EDDF
_wcslen.LIBCMT ref: 0064EDEF
_wcslen.LIBCMT ref: 0064EE2B
_wcslen.LIBCMT ref: 0064EE5A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 7a648ebc5dd832a34623f2c0eefaeffcc99e6c72d8cbd6a005cd6ee3bb7de1bc
Instruction ID: 30faf002ca3a07471aaa69b0bde8800d20bfaeaf51f0222ac033bbeaed338358
Opcode Fuzzy Hash: 7a648ebc5dd832a34623f2c0eefaeffcc99e6c72d8cbd6a005cd6ee3bb7de1bc
Instruction Fuzzy Hash: 2C41D365C50218B5CB55EBF4C88A9CFB7AAAF05310F10856AF618E3161FB34E355C3E9

Function 005FF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0063682C,00000004,00000000,00000000), ref: 005FF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0063682C,00000004,00000000,00000000), ref: 0063F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0063682C,00000004,00000000,00000000), ref: 0063F454

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: c9464742ef4917d1ce2d709d044f579143d5b09bdb020e981aee0e1cb00e5597
Instruction ID: dbbc252f01b319c55ac2c60b0dcef6cf6f5e8331c0cd25f932c498f447242bd1
Opcode Fuzzy Hash: c9464742ef4917d1ce2d709d044f579143d5b09bdb020e981aee0e1cb00e5597
Instruction Fuzzy Hash: 29415D31604688BED7389B29CA9877B7F93BF46310F54543CE24B56E71C6BA98C0CB51

Function 00672D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00672D1B
GetDC.USER32(00000000), ref: 00672D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00672D2E
ReleaseDC.USER32(00000000,00000000), ref: 00672D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00672D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00672D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00675A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00672DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00672DE1

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: a54bbc0e8445de19c1467ce3b27a64057645d1a0b4ea95422e48d1b96126901c
Instruction ID: 6f0818e4e7ce795f4986b317368b0f18f6ec32d7d391d9fa32a4c2892c682879
Opcode Fuzzy Hash: a54bbc0e8445de19c1467ce3b27a64057645d1a0b4ea95422e48d1b96126901c
Instruction Fuzzy Hash: 43317F72201214BFEB258F50CC89FEB3BAAEF09725F044059FE0C9A291D6759C90C7A4

Function 00645622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00645637
_memcmp.LIBVCRUNTIME ref: 00645659
_memcmp.LIBVCRUNTIME ref: 00645671
_memcmp.LIBVCRUNTIME ref: 00645684
_memcmp.LIBVCRUNTIME ref: 0064569E
_memcmp.LIBVCRUNTIME ref: 006456B1
_memcmp.LIBVCRUNTIME ref: 006456C9
_memcmp.LIBVCRUNTIME ref: 006456E4

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: dd74d967965bd07f929ded3e5a358caeeb2fd83677c12d29a64f234893c0f010
Instruction ID: 355c2821a35739f5d1b7e3febe1ed8bdbd9fd0e9e9ab5632f43b2bddc71544cc
Opcode Fuzzy Hash: dd74d967965bd07f929ded3e5a358caeeb2fd83677c12d29a64f234893c0f010
Instruction Fuzzy Hash: A821F861680A0977D31C56104EA2FFB334FEF22784F454034FD0A5A683FB21ED1285A9

Function 00664FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0066502E, 00665383
Not an Object type, xrefs: 00665007

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: b25844e113c72a5a2419f7ba7ed0c323219da8a1385382d94c5b82e5a932a406
Instruction ID: bbc93de774269523e4ba780df82c812370b76691c6cce539e10639ae092fa2c6
Opcode Fuzzy Hash: b25844e113c72a5a2419f7ba7ed0c323219da8a1385382d94c5b82e5a932a406
Instruction Fuzzy Hash: E3D1B571A0060AAFDF14DF98C882BEEB7B6BF48354F148069E916AB381E771DD45CB50

Function 00621522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 006215CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00621651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 006216E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 006216FB

Part of subcall function 00613820: RtlAllocateHeap.NTDLL(00000000,?,006B1444,?,005FFDF5,?,?,005EA976,00000010,006B1440,005E13FC,?,005E13C6,?,005E1129), ref: 00613852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00621777
__freea.LIBCMT ref: 006217A2
__freea.LIBCMT ref: 006217AE

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: e6d2f0157a62d06dda45dc8d73e53a7d2b99eebbccab469d3ebd97ffecb734cc
Instruction ID: f738f5e4c9e57bdee10dec93c0f536ae209ddba88366f0a615c40192729bcc0e
Opcode Fuzzy Hash: e6d2f0157a62d06dda45dc8d73e53a7d2b99eebbccab469d3ebd97ffecb734cc
Instruction Fuzzy Hash: B291D671E08A265ADF208E74E851AEE7BB79FA6310F184569E805EF281D735CD41CFA0

Function 00664523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00664648
VariantInit.OLEAUT32(?), ref: 00664749
VariantClear.OLEAUT32(?), ref: 00664753
VariantClear.OLEAUT32(?), ref: 006647B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0066472C
Null Object assignment in FOR..IN loop, xrefs: 006645D8, 00664706, 006647BE

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: d20e903c013cfefe7b6c3580440962cc81570b22b44d0c5a03d228d6098f86b8
Instruction ID: 3ee94f51d69eeadf5297773d759b53ee5f71ac5b5f355123886b8166435b68b8
Opcode Fuzzy Hash: d20e903c013cfefe7b6c3580440962cc81570b22b44d0c5a03d228d6098f86b8
Instruction Fuzzy Hash: 93916171A00219ABDF24CFA5CC44FEE7BBAEF46714F108559F515AB280DB709945CFA0

Function 00651187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0065125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00651284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 006512A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 006512D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0065135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 006513C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00651430

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 3af14eaff8000b723eedc7056120a13649f03bfc71cda30779486b1285a63a36
Instruction ID: ad89ad03cd0676d3dba5d3a3ca6a4dee01e5b244cd24402a1a8669b0bebaabd4
Opcode Fuzzy Hash: 3af14eaff8000b723eedc7056120a13649f03bfc71cda30779486b1285a63a36
Instruction Fuzzy Hash: 4591C271A00219AFDB04DF94C885BBEB7F6FF46326F144029E950EB291D774A989CB90

Function 005F948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 7a3a3b62beacc4ccd0f7508fc1a6925b93e4c6820b1ab2a95a01cf8ae81e0182
Instruction ID: 1747835b8e7394a1432c9e44f7cd620bed40dd3dc43e8fa2724f182040d580b5
Opcode Fuzzy Hash: 7a3a3b62beacc4ccd0f7508fc1a6925b93e4c6820b1ab2a95a01cf8ae81e0182
Instruction Fuzzy Hash: C3912771D00619EFCB14CFA9C888AEEBFB9FF49320F144459E615B7251D379AA41CBA0

Function 00663947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0066396B
CharUpperBuffW.USER32(?,?), ref: 00663A7A
_wcslen.LIBCMT ref: 00663A8A
VariantClear.OLEAUT32(?), ref: 00663C1F

Part of subcall function 00650CDF: VariantInit.OLEAUT32(00000000), ref: 00650D1F
Part of subcall function 00650CDF: VariantCopy.OLEAUT32(?,?), ref: 00650D28
Part of subcall function 00650CDF: VariantClear.OLEAUT32(?), ref: 00650D34

Strings

AUTOIT.ERROR, xrefs: 00663A80, 00663A85
Incorrect Parameter format, xrefs: 006639A6, 00663BA1

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 2efea55af6e8ded9a72a428b67d3ca573675bcd83b036dfbba84fa429c220eaa
Instruction ID: d5458466978275437a61287ab1770bc77e7184896058b572bae791cb253decb0
Opcode Fuzzy Hash: 2efea55af6e8ded9a72a428b67d3ca573675bcd83b036dfbba84fa429c220eaa
Instruction Fuzzy Hash: E09178746083459FC704EF24C48596ABBE6FF89314F14896EF88A9B351DB30EE45CB92

Function 00664BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0064000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?,?,0064035E), ref: 0064002B
Part of subcall function 0064000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?), ref: 00640046
Part of subcall function 0064000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?), ref: 00640054
Part of subcall function 0064000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?), ref: 00640064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00664C51
_wcslen.LIBCMT ref: 00664D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00664DCF
CoTaskMemFree.OLE32(?), ref: 00664DDA

Strings

NULL Pointer assignment, xrefs: 00664E23, 00664E52

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 8f5f2750d8425c2cdfbeaa5790035a9ff7d5ca5ae7c01533c956a921e7a2ed7a
Instruction ID: 93429cee705177eeb2a8be140b08f64a63a670eef336b293bb89097a544cf511
Opcode Fuzzy Hash: 8f5f2750d8425c2cdfbeaa5790035a9ff7d5ca5ae7c01533c956a921e7a2ed7a
Instruction Fuzzy Hash: 51911771D0021DAFDF14DFA4C895AEEBBBABF48310F108169E915A7251EB319E45CF60

Function 006720FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00672183
GetMenuItemCount.USER32(00000000), ref: 006721B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 006721DD
_wcslen.LIBCMT ref: 00672213
GetMenuItemID.USER32(?,?), ref: 0067224D
GetSubMenu.USER32(?,?), ref: 0067225B

Part of subcall function 00643A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00643A57
Part of subcall function 00643A3D: GetCurrentThreadId.KERNEL32 ref: 00643A5E
Part of subcall function 00643A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006425B3), ref: 00643A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 006722E3

Part of subcall function 0064E97B: Sleep.KERNELBASE ref: 0064E9F3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 73c19b45bc387aa045e9962455863ed6d8ea27e32b5e6973a2afbe042516d873
Instruction ID: 0f35a134719124490a2891cb6bde6fb3e2f1db033d4a10f8c4d55c5474fe71c6
Opcode Fuzzy Hash: 73c19b45bc387aa045e9962455863ed6d8ea27e32b5e6973a2afbe042516d873
Instruction Fuzzy Hash: A8718375E00206AFCB14DF65C855AAEBBF6FF88310F148459E96AEB341D734EE418B90

Function 00677E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(013A4F48), ref: 00677F37
IsWindowEnabled.USER32(013A4F48), ref: 00677F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0067801E
SendMessageW.USER32(013A4F48,000000B0,?,?), ref: 00678051
IsDlgButtonChecked.USER32(?,?), ref: 00678089
GetWindowLongW.USER32(013A4F48,000000EC), ref: 006780AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 006780C3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: d0c51dadda0b491d7f66c9ae841f47455675fa83933e104cd3b0d74dab729ada
Instruction ID: 8776ddb04095188e5648f1d9d8ceccda956b1c98053b74f9fa306cb94a6ff6ab
Opcode Fuzzy Hash: d0c51dadda0b491d7f66c9ae841f47455675fa83933e104cd3b0d74dab729ada
Instruction Fuzzy Hash: 59719E74608244AFEB25DF64C994FEABBB7EF09300F148459E94997361CB35AC85CB20

Function 0064AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0064AEF9
GetKeyboardState.USER32(?), ref: 0064AF0E
SetKeyboardState.USER32(?), ref: 0064AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0064AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0064AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0064AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0064B020

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: b7c034c7107941e28fd0234d2180df54f598156f6aa080bbe306b5efcf09deb7
Instruction ID: cd1e3edad2754439fc722ec1824e8e785bc10c667a1c3a237c74adc6308bf162
Opcode Fuzzy Hash: b7c034c7107941e28fd0234d2180df54f598156f6aa080bbe306b5efcf09deb7
Instruction Fuzzy Hash: 9751EEA0A543D13DFB368274C845BFBBEAA5B06704F08948DE1E9859C2C3D8EDC8D761

Function 0064ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0064AD19
GetKeyboardState.USER32(?), ref: 0064AD2E
SetKeyboardState.USER32(?), ref: 0064AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0064ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0064ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0064AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0064AE38

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: da9dfb8c0685fc3e04f1255d1fa66f68b29a893cae6fd5fe3c779885aa602ab5
Instruction ID: 07b43df69c4daeb097a2af844f5cea5ffcc690e6f926761e41cadcb0a10bd32a
Opcode Fuzzy Hash: da9dfb8c0685fc3e04f1255d1fa66f68b29a893cae6fd5fe3c779885aa602ab5
Instruction Fuzzy Hash: C351E6B19887D53DFB3683B4CC95BFA7EAA5F46300F08858CE1E5469C2C294ED84E752

Function 0061542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00623CD6,?,?,?,?,?,?,?,?,00615BA3,?,?,00623CD6,?,?), ref: 00615470
__fassign.LIBCMT ref: 006154EB
__fassign.LIBCMT ref: 00615506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00623CD6,00000005,00000000,00000000), ref: 0061552C
WriteFile.KERNEL32(?,00623CD6,00000000,00615BA3,00000000,?,?,?,?,?,?,?,?,?,00615BA3,?), ref: 0061554B
WriteFile.KERNEL32(?,?,00000001,00615BA3,00000000,?,?,?,?,?,?,?,?,?,00615BA3,?), ref: 00615584

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 29e308062944911559d36950980581caef22c12d5dbe62a4162b38e16d4cb9e7
Instruction ID: 0c24f0aa6f6403ef77ecc1234cdcd1e888cf7bca6f4cc36a58f7a6ea03a1fc2b
Opcode Fuzzy Hash: 29e308062944911559d36950980581caef22c12d5dbe62a4162b38e16d4cb9e7
Instruction Fuzzy Hash: C851B570A00649DFDB10CFA8D845AEEFBFBEF49310F18415AE556E7291D7309A81CB60

Function 006610B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0066304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0066307A
Part of subcall function 0066304E: _wcslen.LIBCMT ref: 0066309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00661112
WSAGetLastError.WSOCK32 ref: 00661121
WSAGetLastError.WSOCK32 ref: 006611C9
closesocket.WSOCK32(00000000), ref: 006611F9

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: c3ae39619773eadf68157e971b254672e59fb9c2bbdd4ee1ddfc0d9166e4146b
Instruction ID: 2b34f2ba293abdb76f31432312d3f21edae4febe4dda49a152668cae347c8a4f
Opcode Fuzzy Hash: c3ae39619773eadf68157e971b254672e59fb9c2bbdd4ee1ddfc0d9166e4146b
Instruction Fuzzy Hash: A741C331600214AFDB149F14C845BA9BBEAFF86324F188059F9599F391C774ED81CBA1

Function 0064CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0064CF22,?), ref: 0064DDFD

Part of subcall function 0064DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0064CF22,?), ref: 0064DE16

lstrcmpiW.KERNEL32(?,?), ref: 0064CF45
MoveFileW.KERNEL32(?,?), ref: 0064CF7F
_wcslen.LIBCMT ref: 0064D005
_wcslen.LIBCMT ref: 0064D01B
SHFileOperationW.SHELL32(?), ref: 0064D061

Strings

\*.*, xrefs: 0064CFF3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: df902411d178f2ebcf54196c99447c43aea6aa7a693ea5951f04b7c374ba804c
Instruction ID: e95a028ac4084a6ba5ba1deb456d3d5169f04d28a4d4f9a90744fbebffdb6d8a
Opcode Fuzzy Hash: df902411d178f2ebcf54196c99447c43aea6aa7a693ea5951f04b7c374ba804c
Instruction Fuzzy Hash: D3417871D451189FDF56EFA4C981ADEB7BAAF44340F0000EAE505EB241EB35A788CB54

Function 00672DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00672E1C
GetWindowLongW.USER32(?,000000F0), ref: 00672E4F
GetWindowLongW.USER32(?,000000F0), ref: 00672E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00672EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00672EE0
GetWindowLongW.USER32(?,000000F0), ref: 00672EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00672F0B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 2f3cdc491783693048339204320780b8d2cf63bc09eccfb4a5cb4db26e11f652
Instruction ID: 2ad7c7387f627a830187f5ebe54a61839a7e37e9869e0100a5e42115568cef0f
Opcode Fuzzy Hash: 2f3cdc491783693048339204320780b8d2cf63bc09eccfb4a5cb4db26e11f652
Instruction Fuzzy Hash: 22310630644152AFEB21DF58DCE4FA537E2FB4A720F155168FA489F2B1CB71A880DB41

Function 00647726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00647769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0064778F
SysAllocString.OLEAUT32(00000000), ref: 00647792
SysAllocString.OLEAUT32(?), ref: 006477B0
SysFreeString.OLEAUT32(?), ref: 006477B9
StringFromGUID2.OLE32(?,?,00000028), ref: 006477DE
SysAllocString.OLEAUT32(?), ref: 006477EC

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: e14e2c8373ff41c1e1f42c6c238b553a079a42dc86dc18c1df864d1058c64ef3
Instruction ID: a8ee1178fd169518026fb999453b50154e0ffa5849d7f1f5fc81abab3c7e4343
Opcode Fuzzy Hash: e14e2c8373ff41c1e1f42c6c238b553a079a42dc86dc18c1df864d1058c64ef3
Instruction Fuzzy Hash: 69219276604219AFDB10DFA8CC88CFB77EEEB097647448029FA15DB251D770DC8587A0

Function 006477FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00647842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00647868
SysAllocString.OLEAUT32(00000000), ref: 0064786B
SysAllocString.OLEAUT32 ref: 0064788C
SysFreeString.OLEAUT32 ref: 00647895
StringFromGUID2.OLE32(?,?,00000028), ref: 006478AF
SysAllocString.OLEAUT32(?), ref: 006478BD

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 2b06496132a48e739b7a326bb62897df1eee48d47f39d5cf8f0622e9865fbabd
Instruction ID: 4214ad62b181740cfcc8eb4e5b926bb7938473ca13571a6131d90912e2751ae5
Opcode Fuzzy Hash: 2b06496132a48e739b7a326bb62897df1eee48d47f39d5cf8f0622e9865fbabd
Instruction Fuzzy Hash: 9D217131608204AFDB14AFA8DC8CDBA77EDEB097607108135FA15DB2A5E774DC81CB64

Function 006504D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 006504F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0065052E

Strings

nul, xrefs: 00650567

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 7991167c53da036b01b0ef71105cc62ae18ce2ce33421e669860087a9d9673d1
Instruction ID: 42020c414daf10b3bdb2077e1fd0e07dfe46f168576607e5e6c99c36f3ecb53b
Opcode Fuzzy Hash: 7991167c53da036b01b0ef71105cc62ae18ce2ce33421e669860087a9d9673d1
Instruction Fuzzy Hash: 85216DB5500305EBEB209F29DD45A9A77A6AF44726F204A19FCA5E62E0E770D948CF20

Function 006505A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 006505C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00650601

Strings

nul, xrefs: 00650639

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: ee9fc84a14ffe2e16fe27b7fd0d62b097e3498bd69ae1685e2e070a147591be3
Instruction ID: 90e4da3f684beb2ce34f392747ff12428f8798242ae7fc52f597b080dceb156e
Opcode Fuzzy Hash: ee9fc84a14ffe2e16fe27b7fd0d62b097e3498bd69ae1685e2e070a147591be3
Instruction Fuzzy Hash: 772181755003069BEB209F69CC04A9A77E6AF95731F240A19FCA1E72E0E770D9A5CB20

Function 006740AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 005E604C
Part of subcall function 005E600E: GetStockObject.GDI32(00000011), ref: 005E6060
Part of subcall function 005E600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 005E606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00674112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0067411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0067412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00674139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00674145

Strings

Msctls_Progress32, xrefs: 006740E3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: f514150b4df494bcf8208e7cedff45a4dbb8587e65b0c54aa6456c9dae4ed7f2
Instruction ID: fffebb132d6458e5803ea8860df27eeb342e6d27930fb28a2f9fd31d6a30c2d7
Opcode Fuzzy Hash: f514150b4df494bcf8208e7cedff45a4dbb8587e65b0c54aa6456c9dae4ed7f2
Instruction Fuzzy Hash: 3911B6B11401197EEF119F64CC85EE77F5EFF09798F018110F618A6150CB729C61DBA4

Function 0061D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0061D7A3: _free.LIBCMT ref: 0061D7CC

_free.LIBCMT ref: 0061D82D

Part of subcall function 006129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000), ref: 006129DE
Part of subcall function 006129C8: GetLastError.KERNEL32(00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000,00000000), ref: 006129F0

_free.LIBCMT ref: 0061D838
_free.LIBCMT ref: 0061D843
_free.LIBCMT ref: 0061D897
_free.LIBCMT ref: 0061D8A2
_free.LIBCMT ref: 0061D8AD
_free.LIBCMT ref: 0061D8B8

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 69ce54f5da642d403c576c4e21615006a21a7756319262f6d2f43e4e23b24acf
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 47115171540B04AAD5A1BFB1CC47FCB7BDE6F00710F4C0C2DB299AA0E2DAA5F5A54654

Function 0064DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0064DA74
LoadStringW.USER32(00000000), ref: 0064DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0064DA91
LoadStringW.USER32(00000000), ref: 0064DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0064DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0064DAB9

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 8aa411608751b0d8f96ea1d1deed7f2069c17a79d8ea81ce93d7155afe8b135a
Instruction ID: a947736437c3a7d026aba3721e9c2fb2d035ff679e1023522271e2abb8ba7d6f
Opcode Fuzzy Hash: 8aa411608751b0d8f96ea1d1deed7f2069c17a79d8ea81ce93d7155afe8b135a
Instruction Fuzzy Hash: 6D0186F2900208BFE715ABA4DD89EE7376DE708711F4054A9B70AE2141EA749EC44F74

Function 0065096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0139E4B0,0139E4B0), ref: 0065097B
EnterCriticalSection.KERNEL32(0139E490,00000000), ref: 0065098D
TerminateThread.KERNEL32(?,000001F6), ref: 0065099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 006509A9
CloseHandle.KERNEL32(?), ref: 006509B8
InterlockedExchange.KERNEL32(0139E4B0,000001F6), ref: 006509C8
LeaveCriticalSection.KERNEL32(0139E490), ref: 006509CF

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: ce9877aef543c41e0f11e235279a27bf0b927f9cc803c9325bff95247f6c8c0d
Instruction ID: 01fb212f6ccf43c784927cd31ce3ef441d9ba2312976b8ddcbfebebde9d7e013
Opcode Fuzzy Hash: ce9877aef543c41e0f11e235279a27bf0b927f9cc803c9325bff95247f6c8c0d
Instruction Fuzzy Hash: BDF03132442902BBE7455F94EE8CBD6BB36FF01712F403029F205608A5D77495A5DF90

Function 005E5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 005E5D30
GetWindowRect.USER32(?,?), ref: 005E5D71
ScreenToClient.USER32(?,?), ref: 005E5D99
GetClientRect.USER32(?,?), ref: 005E5ED7
GetWindowRect.USER32(?,?), ref: 005E5EF8

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: c6d128907db60b0522e2d5829f9f9e51cd93b87c93fd97eae3fc905da3a9778d
Instruction ID: 23fc5dd7be7e6158c1a6565e3940f70c6fbede11ecd899aed35e2830c41d6e2f
Opcode Fuzzy Hash: c6d128907db60b0522e2d5829f9f9e51cd93b87c93fd97eae3fc905da3a9778d
Instruction Fuzzy Hash: DCB17C35A00A8ADBDB14CFA9C4407EABBF6FF44314F14941AE8A9D7250EB34EA51DB50

Function 006101B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 006100BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006100D6
__allrem.LIBCMT ref: 006100ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0061010B
__allrem.LIBCMT ref: 00610122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00610140

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: f7429e64969d336b38c291eceaeeea3b73c2cfc00f1e0eaebc3135604d12aaf6
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: BF81F571A00706ABEB249F68CC42BEB73EAAF45364F28412DF451D67C1EBB4D9808B54

Function 00661D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00663149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,0066101C,00000000,?,?,00000000), ref: 00663195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00661DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00661DE1
WSAGetLastError.WSOCK32 ref: 00661DF2
inet_ntoa.WSOCK32(?), ref: 00661E8C
htons.WSOCK32(?,?,?,?,?), ref: 00661EDB
_strlen.LIBCMT ref: 00661F35

Part of subcall function 006439E8: _strlen.LIBCMT ref: 006439F2

Part of subcall function 005E6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,005FCF58,?,?,?), ref: 005E6DBA
Part of subcall function 005E6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,005FCF58,?,?,?), ref: 005E6DED

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: eeebd2d0c059436db2bc4fa080da34534cc309dfc334540452a18afa05b832cb
Instruction ID: 0d49e5ab05469deca27c3ffb7f979ddbf2f97e0463b0cc4021d679120335b36d
Opcode Fuzzy Hash: eeebd2d0c059436db2bc4fa080da34534cc309dfc334540452a18afa05b832cb
Instruction Fuzzy Hash: DBA1BE30504341AFC324DB20C899E6A7BE6BFC5318F58894CF5965F2A2DB31ED46CB92

Function 006161FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,006082D9,006082D9,?,?,?,0061644F,00000001,00000001,8BE85006), ref: 00616258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0061644F,00000001,00000001,8BE85006,?,?,?), ref: 006162DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 006163D8
__freea.LIBCMT ref: 006163E5

Part of subcall function 00613820: RtlAllocateHeap.NTDLL(00000000,?,006B1444,?,005FFDF5,?,?,005EA976,00000010,006B1440,005E13FC,?,005E13C6,?,005E1129), ref: 00613852

__freea.LIBCMT ref: 006163EE
__freea.LIBCMT ref: 00616413

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 367ed1ecd34bb8584fd2950be28120ba029a3e457f88c0369b630359bce8668e
Instruction ID: ed84a7caffb3cd87ae7b560c46fd7aea1cf7cc5c9509c96f94cdb10d82389c26
Opcode Fuzzy Hash: 367ed1ecd34bb8584fd2950be28120ba029a3e457f88c0369b630359bce8668e
Instruction Fuzzy Hash: E251E076A00216ABEB298F64CC81EEF77ABEB44710F18422DFC15D6240EB34DCC1C6A0

Function 0066BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 0066C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0066B6AE,?,?), ref: 0066C9B5
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066C9F1
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA68
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0066BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0066BD25
RegCloseKey.ADVAPI32(00000000), ref: 0066BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0066BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0066BDF3
RegCloseKey.ADVAPI32(?), ref: 0066BDFF

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 8cea6fdd6961defa964d9af900053c64066d52822a29d42880a4f012eedfb004
Instruction ID: 4f820cec003cf484a1ecb400b09f1aa1c9ca986af081faf609ff578d7bb689d1
Opcode Fuzzy Hash: 8cea6fdd6961defa964d9af900053c64066d52822a29d42880a4f012eedfb004
Instruction Fuzzy Hash: 3C81B470108241EFD714DF24C885E6ABBE6FF84308F14955CF5998B2A2DB32ED85CB92

Function 0063F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0063F7B9
SysAllocString.OLEAUT32(00000001), ref: 0063F860
VariantCopy.OLEAUT32(0063FA64,00000000), ref: 0063F889
VariantClear.OLEAUT32(0063FA64), ref: 0063F8AD
VariantCopy.OLEAUT32(0063FA64,00000000), ref: 0063F8B1
VariantClear.OLEAUT32(?), ref: 0063F8BB

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: ecc42479e220e26c99c935040a58785aa3d6b2178a1ceafbad7304082e14c2ab
Instruction ID: 0bb02387b43e9e256fefeddca2c028e151cf913468827af54b826cb6c9a71c14
Opcode Fuzzy Hash: ecc42479e220e26c99c935040a58785aa3d6b2178a1ceafbad7304082e14c2ab
Instruction Fuzzy Hash: 5F51E431E00311BACF24AB65D895B69B7EAEF45310F20946BE906DF2D5EB708C41C7D6

Function 0065910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 005E7620: _wcslen.LIBCMT ref: 005E7625

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 006594E5
_wcslen.LIBCMT ref: 00659506
_wcslen.LIBCMT ref: 0065952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00659585

Strings

X, xrefs: 00659412

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: f34dac5f9ce93eb3d541f43832fbb87a8cd099eaa15251efc28afa4477057d27
Instruction ID: 5c6f7b347b2e06db174343498fc8d4696526d7878319b99d2a6b692a29c00c4d
Opcode Fuzzy Hash: f34dac5f9ce93eb3d541f43832fbb87a8cd099eaa15251efc28afa4477057d27
Instruction Fuzzy Hash: 36E1A231504341CFD728DF25C885A6ABBE1BFC5314F14896DE9899B3A2EB31DD05CBA1

Function 005F920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

BeginPaint.USER32(?,?,?), ref: 005F9241
GetWindowRect.USER32(?,?), ref: 005F92A5
ScreenToClient.USER32(?,?), ref: 005F92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 005F92D3
EndPaint.USER32(?,?,?,?,?), ref: 005F9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 006371EA

Part of subcall function 005F9339: BeginPath.GDI32(00000000), ref: 005F9357

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 74782ea4865819e9dfb4c0ef44d400e86d9ae3e89ec8e51680f187d423d8a642
Instruction ID: e1c9d197a3c2ae1776eacfdc97a355b4c911ae2c9458e30b12c7d5a513334d3e
Opcode Fuzzy Hash: 74782ea4865819e9dfb4c0ef44d400e86d9ae3e89ec8e51680f187d423d8a642
Instruction Fuzzy Hash: 2C41B271104605AFD721EF24CC98FBA7FAAFF46320F140629FA548B2E1C7359885DB61

Function 006507EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0065080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00650847
EnterCriticalSection.KERNEL32(?), ref: 00650863
LeaveCriticalSection.KERNEL32(?), ref: 006508DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 006508F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00650921

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 63b8be19e662e39082196afef70f927d0a29aad4543ce1304a39c4d08b53dbbf
Instruction ID: 0bf23a85fe1a0f961bd547e4676750d330f7b115f417b4a7a0886eccc219cff5
Opcode Fuzzy Hash: 63b8be19e662e39082196afef70f927d0a29aad4543ce1304a39c4d08b53dbbf
Instruction Fuzzy Hash: E2416B71900206EBEF14AF54DC85AAA777AFF44310F1440A9EE04AF297D730EE64DBA4

Function 006781DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0063F3AB,00000000,?,?,00000000,?,0063682C,00000004,00000000,00000000), ref: 0067824C
EnableWindow.USER32(?,00000000), ref: 00678272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 006782D1
ShowWindow.USER32(?,00000004), ref: 006782E5
EnableWindow.USER32(?,00000001), ref: 0067830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0067832F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 86dfc3a9f048f28103e52bc5f761d60c893500c2aa3d7479888f29acc4d1225d
Instruction ID: b5df0a03294b401045642491790f906d8dd0bb6087e85fa53fd03824aa79e96f
Opcode Fuzzy Hash: 86dfc3a9f048f28103e52bc5f761d60c893500c2aa3d7479888f29acc4d1225d
Instruction Fuzzy Hash: 8841A430641644AFDB25CF54D8ADBE47BE2BB06725F189269E61C4F363CB31AD81CB90

Function 00644C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00644C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00644CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00644CEA
_wcslen.LIBCMT ref: 00644D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00644D10
_wcsstr.LIBVCRUNTIME ref: 00644D1A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 068757399853ec843ad975c21e0c3bc0e2c0bc26d88f1fc7b65ea426d42ccd61
Instruction ID: b80eb3aafadcbfcf03c6b8412069aa9cf7709381ea0e721d15054c5334353a08
Opcode Fuzzy Hash: 068757399853ec843ad975c21e0c3bc0e2c0bc26d88f1fc7b65ea426d42ccd61
Instruction Fuzzy Hash: 702107316042057BEB155B25AC8AF7B7F9EDF45760F10402DF909CA292DE61CC4182A0

Function 0065581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 005E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005E3A97,?,?,005E2E7F,?,?,?,00000000), ref: 005E3AC2

_wcslen.LIBCMT ref: 0065587B
CoInitialize.OLE32(00000000), ref: 00655995
CoCreateInstance.OLE32(0067FCF8,00000000,00000001,0067FB68,?), ref: 006559AE
CoUninitialize.OLE32 ref: 006559CC

Strings

.lnk, xrefs: 00655876, 006558C1, 00655985

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 91105919f7030ba41a13bb736c1beb03d14e9a127ba982b1d058628693411aac
Instruction ID: ec0d718fc2aadf68faaa88152400d2a7f623ac0197d414521152471c9e1589e7
Opcode Fuzzy Hash: 91105919f7030ba41a13bb736c1beb03d14e9a127ba982b1d058628693411aac
Instruction Fuzzy Hash: A1D176706087019FC718DF15C4A896ABBE2FF89711F14885DF88A9B361D731EC49CB92

Function 0064175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00640FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00640FCA
Part of subcall function 00640FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00640FD6
Part of subcall function 00640FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00640FE5
Part of subcall function 00640FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00640FEC
Part of subcall function 00640FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00641002

GetLengthSid.ADVAPI32(?,00000000,00641335), ref: 006417AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 006417BA
HeapAlloc.KERNEL32(00000000), ref: 006417C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 006417DA
GetProcessHeap.KERNEL32(00000000,00000000,00641335), ref: 006417EE
HeapFree.KERNEL32(00000000), ref: 006417F5

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: b92dd594ae9a1ba438d59ccf8978514a63098afaadc9c7d0125b0dab4e16ce26
Instruction ID: 6d1557352882a7c55aa4eac6401eae07793e12cde921912a475a2e8ba9cfb5ee
Opcode Fuzzy Hash: b92dd594ae9a1ba438d59ccf8978514a63098afaadc9c7d0125b0dab4e16ce26
Instruction Fuzzy Hash: 54118E31510205FFDB149FA4CC49BEE7BBAEB46365F10402CF4459B210D736AA84DB60

Function 006414CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 006414FF
OpenProcessToken.ADVAPI32(00000000), ref: 00641506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00641515
CloseHandle.KERNEL32(00000004), ref: 00641520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0064154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00641563

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: ce0f748aa17c5162214b7731fbe1e81ba403a243dc79d36e3f659417d09c89ba
Instruction ID: 073bbe8ffa600ed861c8fcc3e60ef7205cd431dbb748e6818f9a455b339d6f00
Opcode Fuzzy Hash: ce0f748aa17c5162214b7731fbe1e81ba403a243dc79d36e3f659417d09c89ba
Instruction Fuzzy Hash: E511597250020DABDF15CFA8DD49FDE7BAAEF49714F044018FA09A6160D3728EA0DB60

Function 00603382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00603379,00602FE5), ref: 00603390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0060339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006033B7
SetLastError.KERNEL32(00000000,?,00603379,00602FE5), ref: 00603409

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d5f7bedd9ca72371ce5c9b02872697965f919414e1ebc5b875eec4a8cf5b8db2
Instruction ID: 68dfd684eff790dbc6e21702e8e10295fdad74c8efef50d32fae7f8e8037992b
Opcode Fuzzy Hash: d5f7bedd9ca72371ce5c9b02872697965f919414e1ebc5b875eec4a8cf5b8db2
Instruction Fuzzy Hash: 3801F532298331AEE72C37746CD55972A9FDB16377320022DF510843F0FF125D415548

Function 00612D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00615686,00623CD6,?,00000000,?,00615B6A,?,?,?,?,?,0060E6D1,?,006A8A48), ref: 00612D78
_free.LIBCMT ref: 00612DAB
_free.LIBCMT ref: 00612DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0060E6D1,?,006A8A48,00000010,005E4F4A,?,?,00000000,00623CD6), ref: 00612DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0060E6D1,?,006A8A48,00000010,005E4F4A,?,?,00000000,00623CD6), ref: 00612DEC
_abort.LIBCMT ref: 00612DF2

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 73452fec22f46267444d75ca23bb3f18d4f2fe0e33fe57763f93ff0af18b75e3
Instruction ID: f09a94efcfee299e4b74e6409647a928a6eade209901af1a47e39601798ad558
Opcode Fuzzy Hash: 73452fec22f46267444d75ca23bb3f18d4f2fe0e33fe57763f93ff0af18b75e3
Instruction Fuzzy Hash: A3F0F9319445026BC3523339FC26ADA15576FC2771B2C041CF828922D1EE2098E25274

Function 00678A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 005F9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 005F9693
Part of subcall function 005F9639: SelectObject.GDI32(?,00000000), ref: 005F96A2
Part of subcall function 005F9639: BeginPath.GDI32(?), ref: 005F96B9
Part of subcall function 005F9639: SelectObject.GDI32(?,00000000), ref: 005F96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00678A4E
LineTo.GDI32(?,00000003,00000000), ref: 00678A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00678A70
LineTo.GDI32(?,00000000,00000003), ref: 00678A80
EndPath.GDI32(?), ref: 00678A90
StrokePath.GDI32(?), ref: 00678AA0

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 40e0860e276c67e2b432be79836ab3471060756b2af09c8bb1d6c20ac886332c
Instruction ID: c3d41408ef9c61e0b6bb485857e801f2b3366acda50600ad4e3d38975531f2cb
Opcode Fuzzy Hash: 40e0860e276c67e2b432be79836ab3471060756b2af09c8bb1d6c20ac886332c
Instruction Fuzzy Hash: FE111E7604014DFFDF119F90DC48EEA7F6EEB04364F008015BA199A161C7729D95DFA0

Function 006451FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00645218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00645229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00645230
ReleaseDC.USER32(00000000,00000000), ref: 00645238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0064524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00645261

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 65b7490b4bf11569c943a8aec30a3761928b166fb9474e6bafcb88c62a0e472f
Instruction ID: 8168c1e76518e9f5c5b318da42f28a5d5b97b38b3b9841c3c9327116563c7a54
Opcode Fuzzy Hash: 65b7490b4bf11569c943a8aec30a3761928b166fb9474e6bafcb88c62a0e472f
Instruction Fuzzy Hash: B501A275E00708BBEB149BB59C49E4EBFB9EF48361F04506AFA09A7381D6709D00CFA0

Function 005E1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 005E1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 005E1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 005E1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 005E1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 005E1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 005E1C22

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 8c5ef14dd3ad453c68653a0c0c629c806d37f365bc62128f54c2ddefb00ea911
Instruction ID: 8bcda459a15a34c4db11642b136d98df87d1125697708787293d334a8f91ebd8
Opcode Fuzzy Hash: 8c5ef14dd3ad453c68653a0c0c629c806d37f365bc62128f54c2ddefb00ea911
Instruction Fuzzy Hash: 76016CB09027597DE3008F5A8C85B52FFA8FF19754F00411F915C47941C7F5A864CBE5

Function 0064EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0064EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0064EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0064EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0064EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0064EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0064EB75

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: e95ac2ad8d38da6b900e7aa230840575a943912a7d803214683f146e463c8cc1
Instruction ID: 8e23a32c91740f0e2e26a970e772d628c0afc5d2ce44c42f05dbe81b63c44386
Opcode Fuzzy Hash: e95ac2ad8d38da6b900e7aa230840575a943912a7d803214683f146e463c8cc1
Instruction Fuzzy Hash: BAF0BE72200518BBE7245B629C0EEEF3E7EEFCAB21F00116CF605E1090E7A01A41CAB4

Function 00637439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00637452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00637469
GetWindowDC.USER32(?), ref: 00637475
GetPixel.GDI32(00000000,?,?), ref: 00637484
ReleaseDC.USER32(?,00000000), ref: 00637496
GetSysColor.USER32(00000005), ref: 006374B0

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: a745e8be3e1bf9de6a917050d0a32b2c632af1757e02b7b979bf4dbabafc7246
Instruction ID: ea259b54c4edd496e94d8023ef1513a2baf71d44a602dc15ff0795fa2c62ee03
Opcode Fuzzy Hash: a745e8be3e1bf9de6a917050d0a32b2c632af1757e02b7b979bf4dbabafc7246
Instruction Fuzzy Hash: 27014B31404215EFEB655F64DC08BEE7BB6FB04321F511168F91AA21A1CB312E91AB50

Function 00641874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0064187F
UnloadUserProfile.USERENV(?,?), ref: 0064188B
CloseHandle.KERNEL32(?), ref: 00641894
CloseHandle.KERNEL32(?), ref: 0064189C
GetProcessHeap.KERNEL32(00000000,?), ref: 006418A5
HeapFree.KERNEL32(00000000), ref: 006418AC

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 021370f23acf5c78d61bbb5391a77438ccb24c804f588735bcc3b630098a174f
Instruction ID: 1b107adb3ef701f6b4df5c588d9ebc2012b8dc8d37851bfa53dbd96ce2b3272e
Opcode Fuzzy Hash: 021370f23acf5c78d61bbb5391a77438ccb24c804f588735bcc3b630098a174f
Instruction Fuzzy Hash: 89E0E536004901BBEB055FA1ED0C90ABF3AFF49B32B509228F22991470DB3294A0EF50

Function 005EBBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005EBEB3

Strings

D%k, xrefs: 005EBE9A
D%k, xrefs: 005EBCA2
D%kD%k, xrefs: 005EBCA5
D%k, xrefs: 005EBDED, 005EBD91, 005EBD1B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%k$D%k$D%k$D%kD%k
API String ID: 1385522511-693824438
Opcode ID: db7a82c6acf3fb02eb3dd8aa4a988b0b5f6bfcbac2cfa1765031bf0071255cbf
Instruction ID: e97be456f5d0575418522edb26570c639eefb532ae80976f3cd44d6a292842de
Opcode Fuzzy Hash: db7a82c6acf3fb02eb3dd8aa4a988b0b5f6bfcbac2cfa1765031bf0071255cbf
Instruction Fuzzy Hash: 23917CB5A0424ACFDB18CF5AC4A06AABBF2FF58311F24456DD985AB350D731ED81CB90

Function 00667B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00600242: EnterCriticalSection.KERNEL32(006B070C,006B1884,?,?,005F198B,006B2518,?,?,?,005E12F9,00000000), ref: 0060024D
Part of subcall function 00600242: LeaveCriticalSection.KERNEL32(006B070C,?,005F198B,006B2518,?,?,?,005E12F9,00000000), ref: 0060028A

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 006000A3: __onexit.LIBCMT ref: 006000A9

__Init_thread_footer.LIBCMT ref: 00667BFB

Part of subcall function 006001F8: EnterCriticalSection.KERNEL32(006B070C,?,?,005F8747,006B2514), ref: 00600202
Part of subcall function 006001F8: LeaveCriticalSection.KERNEL32(006B070C,?,005F8747,006B2514), ref: 00600235

Strings

5, xrefs: 00667C78
+Tc, xrefs: 00667E2E
G, xrefs: 00667C7F
Variable must be of type 'Object'., xrefs: 00667C3A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: +Tc$5$G$Variable must be of type 'Object'.
API String ID: 535116098-2992906774
Opcode ID: 02d5ba91ccc08b52266deb456cb4131f32d85fec05a3a8aad699312ee9abb2d0
Instruction ID: 21e806d76d0a9790b531c67ea2385e7d979ccb726af6e0f0c996e74e72ef60f2
Opcode Fuzzy Hash: 02d5ba91ccc08b52266deb456cb4131f32d85fec05a3a8aad699312ee9abb2d0
Instruction Fuzzy Hash: 73915A70A04209AFCB14EF54D8959EDBBB2FF89308F10845DF8469B392DB71AE85CB51

Function 0064C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E7620: _wcslen.LIBCMT ref: 005E7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0064C6EE
_wcslen.LIBCMT ref: 0064C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0064C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0064C7CA

Strings

0, xrefs: 0064C6AF

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 4d19bb5badaa187481a70ac99bd8611b5d9254d08082eb695cf1b9d20c7f12ba
Instruction ID: 483b352497fc27106fe9b26d4b5223d7bc8a101af7a470709955889082004a53
Opcode Fuzzy Hash: 4d19bb5badaa187481a70ac99bd8611b5d9254d08082eb695cf1b9d20c7f12ba
Instruction Fuzzy Hash: DF5104716063019BD7949F28C884BAB7BEAAF85334F040A2DF995D73A1DB70D844CB52

Function 0066AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0066AEA3

Part of subcall function 005E7620: _wcslen.LIBCMT ref: 005E7625

GetProcessId.KERNEL32(00000000), ref: 0066AF38
CloseHandle.KERNEL32(00000000), ref: 0066AF67

Strings

@, xrefs: 0066AE72
<, xrefs: 0066AE6B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: b2bc6ff38d3579dcc295b7721db00339101ec4243316fc399c294396acfe4818
Instruction ID: d817ce228236ce73a9a24fa1f4cdbffc72a35832acec63fc090f690cea4f7c54
Opcode Fuzzy Hash: b2bc6ff38d3579dcc295b7721db00339101ec4243316fc399c294396acfe4818
Instruction Fuzzy Hash: DC717870A0065ADFCB18DF95C488A9EBBF1BF48310F048499E856AB3A2D735ED41CF91

Function 0064719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00647206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0064723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0064724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 006472CF

Strings

DllGetClassObject, xrefs: 00647242

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 39b3c6ac5d7c04470c7b1965995d815fc24d2ce4a4bee47f9717bce2d1ac5cde
Instruction ID: 0ed9790c7d2c172f704b8edeaa947ec7f96c7926b4bb0b36c4aa727c87168d61
Opcode Fuzzy Hash: 39b3c6ac5d7c04470c7b1965995d815fc24d2ce4a4bee47f9717bce2d1ac5cde
Instruction Fuzzy Hash: 0B414C71A04204EFDB55CF64C884A9B7BAAEF45710F1580ADFD099F20AD7B1DE45CBA0

Function 00673D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00673E35
IsMenu.USER32(?), ref: 00673E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00673E92
DrawMenuBar.USER32 ref: 00673EA5

Strings

0, xrefs: 00673D89

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 5fce3f182b463128c111c96bbba0c90d01699575bfec9171b8011180a244236a
Instruction ID: f1c6c5072db198271e3b9b46c933af8cc25fc696cfe23875d67f85752f21af40
Opcode Fuzzy Hash: 5fce3f182b463128c111c96bbba0c90d01699575bfec9171b8011180a244236a
Instruction Fuzzy Hash: 9F415775A01219EFDB14DF50D884AEABBBAFF49360F04812AE909AB350D730AE51DF50

Function 00641DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 00643CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00643CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00641E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00641E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00641EA9

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

Strings

ListBox, xrefs: 00641E25
ComboBox, xrefs: 00641DF0

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 2fae46408b42a6de81ca6cbfc13ccd5b4de1aa3c046b26f9597db24d2a88c1c8
Instruction ID: 7ee8a6008c23e228965b5a1c7d4c227c35d14c7306c583771bb6d01069b8d548
Opcode Fuzzy Hash: 2fae46408b42a6de81ca6cbfc13ccd5b4de1aa3c046b26f9597db24d2a88c1c8
Instruction Fuzzy Hash: B0212C75900105BEDB18AB65DC89CFF7BBAEF86360B10411DF855A72E1DB344D468620

Function 0066C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0066C9F1
_wcslen.LIBCMT ref: 0066CA68
_wcslen.LIBCMT ref: 0066CA9E
_wcslen.LIBCMT ref: 0066CAF9
_wcslen.LIBCMT ref: 0066CB2F
_wcslen.LIBCMT ref: 0066CB7F

Strings

HKLM, xrefs: 0066CA98, 0066CA9D
HKEY_LOCAL_MACHINE, xrefs: 0066CA62, 0066CA67

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 8f294eafcc2b600d2f51692fa61d92463062310c257d2e125fa118f59c3a9b2c
Instruction ID: 51036092b2c40de4da861be6703f8f5369ea3f06d148236e640f85e567631ca3
Opcode Fuzzy Hash: 8f294eafcc2b600d2f51692fa61d92463062310c257d2e125fa118f59c3a9b2c
Instruction Fuzzy Hash: 19310973A409AA4BCB30EFADC8501FF37939BA1760B554129ECC1AB345EA71CD8097A0

Function 00672F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00672F8D
LoadLibraryW.KERNEL32(?), ref: 00672F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00672FA9
DestroyWindow.USER32(?), ref: 00672FB1

Strings

SysAnimate32, xrefs: 00672F68

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 5477791efc4bbeb9305142e2a70da74d5f65bb9e314987557e1cf5f32bbfbc19
Instruction ID: 7d05d3faaa175eae39ec956376ddce6df342116b9c3cd3293193403e74c8046f
Opcode Fuzzy Hash: 5477791efc4bbeb9305142e2a70da74d5f65bb9e314987557e1cf5f32bbfbc19
Instruction Fuzzy Hash: CD21FD7224020AEBEF108F64DCA0EBB37BEEB59764F108218F958D2290D335DC819760

Function 00604D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00604D1E,006128E9,?,00604CBE,006128E9,006A88B8,0000000C,00604E15,006128E9,00000002), ref: 00604D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00604DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00604D1E,006128E9,?,00604CBE,006128E9,006A88B8,0000000C,00604E15,006128E9,00000002,00000000), ref: 00604DC3

Strings

mscoree.dll, xrefs: 00604D86
CorExitProcess, xrefs: 00604D98

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8fc4daa757bad60eb5476f508b53473c93a0d2941a81f750a962385ab4f4745a
Instruction ID: 5d2bac5b542e47d72302811542858c339039a5c2bf55d376b3f45022c7b59841
Opcode Fuzzy Hash: 8fc4daa757bad60eb5476f508b53473c93a0d2941a81f750a962385ab4f4745a
Instruction Fuzzy Hash: E1F04474640208BBEB195F94DC49BDEBFB6EF44761F440168F909A2290CF715984CB91

Function 005E4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,005E4EDD,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 005E4EAE
FreeLibrary.KERNEL32(00000000,?,?,005E4EDD,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4EC0

Strings

kernel32.dll, xrefs: 005E4E94
Wow64DisableWow64FsRedirection, xrefs: 005E4EA8

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 1a506350987cc2981246c7f2eeaa6712a81060b2026103dfa84cf60e06c052a0
Instruction ID: c73afc908fb1ea47db6649ab1044412aed589abaa85ed36b92e3e2c1706b91e6
Opcode Fuzzy Hash: 1a506350987cc2981246c7f2eeaa6712a81060b2026103dfa84cf60e06c052a0
Instruction Fuzzy Hash: 72E0CD35E015725BD3351B266C18B5F6A5EBFC1F72B050129FC08D2201DB60CD4589A1

Function 005E4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00623CDE,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 005E4E74
FreeLibrary.KERNEL32(00000000,?,?,00623CDE,?,006B1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 005E4E87

Strings

kernel32.dll, xrefs: 005E4E5B
Wow64RevertWow64FsRedirection, xrefs: 005E4E6E

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: ff054209f6094ab5b7c0aad0e56c635899db1a535dbce0c12ad410ca5da059d7
Instruction ID: 2236bcee8219522351d8e1d4b612c381c0eb45bde7cabe0840966596241eeb75
Opcode Fuzzy Hash: ff054209f6094ab5b7c0aad0e56c635899db1a535dbce0c12ad410ca5da059d7
Instruction Fuzzy Hash: F1D0C23190267157C72A1B266C08D8F6E1EBF89F3134A0168B808A2110CF20CD41C9D1

Function 00652947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00652C05
DeleteFileW.KERNEL32(?), ref: 00652C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00652C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00652CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00652CC0

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: ec6c8920c69893d0755b0311ffc4d510999aa114d471f68821c2c1a9672442d2
Instruction ID: 83da052ce26a4be776da7faaa9458099bccbcbf8025bba6e4cfe9291fc169ac1
Opcode Fuzzy Hash: ec6c8920c69893d0755b0311ffc4d510999aa114d471f68821c2c1a9672442d2
Instruction Fuzzy Hash: 9CB1717190011AABDF55DBA4CC99EDF7B7EEF49354F0040AAFA09E6141EB309A488F61

Function 0066A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0066A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0066A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0066A468
CloseHandle.KERNEL32(?), ref: 0066A63D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: dd011af8a572ae6650928be2151a49f47eef169c6f9a83271c72ef7cab04ec4c
Instruction ID: 4f5aec0a4ac753b4e42201d502efa598227843e89ea49b3b70b886d51b47b076
Opcode Fuzzy Hash: dd011af8a572ae6650928be2151a49f47eef169c6f9a83271c72ef7cab04ec4c
Instruction Fuzzy Hash: 45A170716043019FD724DF25C88AB2ABBE6AF84714F14885DF5AA9B3D2D770EC418B92

Function 0064E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0064CF22,?), ref: 0064DDFD

Part of subcall function 0064DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0064CF22,?), ref: 0064DE16

Part of subcall function 0064E199: GetFileAttributesW.KERNEL32(?,0064CF95), ref: 0064E19A

lstrcmpiW.KERNEL32(?,?), ref: 0064E473
MoveFileW.KERNEL32(?,?), ref: 0064E4AC
_wcslen.LIBCMT ref: 0064E5EB
_wcslen.LIBCMT ref: 0064E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0064E650

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 54960e5933d03f4d8c85c5ae1a8c19446075419586487e6268c04279f0ad9ac5
Instruction ID: 12f7fff8a19945f143d79dd3a3d692b61eb662c2fa5d3b101eacdf66d04c440b
Opcode Fuzzy Hash: 54960e5933d03f4d8c85c5ae1a8c19446075419586487e6268c04279f0ad9ac5
Instruction Fuzzy Hash: B65197B24083859BC778DB90DC819DF73DEAF84340F00492EF589D3191EF75A688876A

Function 0066B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 0066C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0066B6AE,?,?), ref: 0066C9B5
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066C9F1
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA68
Part of subcall function 0066C998: _wcslen.LIBCMT ref: 0066CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0066BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0066BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0066BB63
RegCloseKey.ADVAPI32(?,?), ref: 0066BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0066BBB3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: c75781639a479e74141392e1e395ac5f9e0868f0d96cf1d76895613cdf288e2e
Instruction ID: d5c731431f95d27be3fb80c39715d998c4ef3151c837a82b0f400fa37556e4d7
Opcode Fuzzy Hash: c75781639a479e74141392e1e395ac5f9e0868f0d96cf1d76895613cdf288e2e
Instruction Fuzzy Hash: 0C61C531108241EFD318DF54C494E6ABBE6FF84318F54955CF4998B2A2DB31ED85CB92

Function 00648BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00648BCD
VariantClear.OLEAUT32 ref: 00648C3E
VariantClear.OLEAUT32 ref: 00648C9D
VariantClear.OLEAUT32(?), ref: 00648D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00648D3B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 2414289cd9e1039053d09f6259131880b89d5fd830a101e5f5e72543c7739c10
Instruction ID: 996e06b2ff584ceab043764fae696bcfd628eebce996f167ae3708ba674179e2
Opcode Fuzzy Hash: 2414289cd9e1039053d09f6259131880b89d5fd830a101e5f5e72543c7739c10
Instruction Fuzzy Hash: 665168B5A01219EFCB14CF68C884AAAB7FAFF89314B158559E909DB354E730E911CF90

Function 00658AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00658BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00658BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00658C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00658C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00658C5F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 7a099a1cad3a1f938704b6223d641b361bf0ec4adc14f8debb88c1c39a3dd3e8
Instruction ID: 652e32b615f85a2c0152e1f58bfe119bc39dba1738ee784e8f48bf0025bc8c25
Opcode Fuzzy Hash: 7a099a1cad3a1f938704b6223d641b361bf0ec4adc14f8debb88c1c39a3dd3e8
Instruction Fuzzy Hash: CF516C35A006199FCB04DF65C885EADBBF6FF48314F088059E849AB362DB35ED55CB90

Function 00668EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00668F40
GetProcAddress.KERNEL32(00000000,?), ref: 00668FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00668FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00669032
FreeLibrary.KERNEL32(00000000), ref: 00669052

Part of subcall function 005FF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00651043,?,753CE610), ref: 005FF6E6
Part of subcall function 005FF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0063FA64,00000000,00000000,?,?,00651043,?,753CE610,?,0063FA64), ref: 005FF70D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 9c4d4a871ffd6536043852c510ba217623613281bd525c12d96f200ad1e4202b
Instruction ID: 13297d92b7f10e3d89f910f9cfbabc297c2c22a85327bd423ed4ead61b84e6b4
Opcode Fuzzy Hash: 9c4d4a871ffd6536043852c510ba217623613281bd525c12d96f200ad1e4202b
Instruction Fuzzy Hash: 8C513B34604245DFCB15DF65C4848ADBBF2FF89324F0481A9E94A9B362DB31ED86CB90

Function 00676B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00676C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00676C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00676C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0065AB79,00000000,00000000), ref: 00676C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00676CC7

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 454e0e495ff5c581a458acad505b507f9063b8b3072da2285bc31dd0ddb084c2
Instruction ID: 75f4df7ee61b30d554ec828444a336112b6fef8c45aac6aaf19f0e14c767f29e
Opcode Fuzzy Hash: 454e0e495ff5c581a458acad505b507f9063b8b3072da2285bc31dd0ddb084c2
Instruction Fuzzy Hash: 0B41D475604504AFD725DF38CC58FE97BA6EB0A360F148268F89DA73E0C371AD51CA40

Function 00612051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006120C3
_free.LIBCMT ref: 006120E3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 95a451f812d069dcf918b35d65b77112e532c64bee7522fac1b94f63c71dd1b9
Instruction ID: c21ab01529a08651838dee9ff975fc75424ddf31c124afc5c153706051f2bcd4
Opcode Fuzzy Hash: 95a451f812d069dcf918b35d65b77112e532c64bee7522fac1b94f63c71dd1b9
Instruction Fuzzy Hash: EB410672A00205AFCB24DF78C891A9EB7F6FF89314F194568E615EB351DB31AD51CB80

Function 005F912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 005F9141
ScreenToClient.USER32(00000000,?), ref: 005F915E
GetAsyncKeyState.USER32(00000001), ref: 005F9183
GetAsyncKeyState.USER32(00000002), ref: 005F919D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: ab5940ddbf6f01d1af2b1151e577a5c2b3924582ea965f2f1108f298896333db
Instruction ID: f3a9a465eadbb3902f1e48eb989430ed63507f788124162cc4fb4dbf955beab9
Opcode Fuzzy Hash: ab5940ddbf6f01d1af2b1151e577a5c2b3924582ea965f2f1108f298896333db
Instruction Fuzzy Hash: 80416F71A0860BFBDF199F64C848BFEBB75FB45324F248229E529A3290C7346950CB91

Function 00653874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 006538CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00653922
TranslateMessage.USER32(?), ref: 0065394B
DispatchMessageW.USER32(?), ref: 00653955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00653966

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 942ddb2a399d9055a9de5a1f99634c9557b538ac9b4e0328efb436905161074f
Instruction ID: b8c07678240200c18199bb9e11c1038343a13d1fd795e6cca8aa825f60439d18
Opcode Fuzzy Hash: 942ddb2a399d9055a9de5a1f99634c9557b538ac9b4e0328efb436905161074f
Instruction Fuzzy Hash: 6E31EAF0504355AEEB39CB34D858BF637EAAB02782F44055DE856C6390F7B496C9CB11

Function 0065CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0065CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0065CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0065C21E,00000000), ref: 0065CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0065C21E,00000000), ref: 0065CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0065C21E,00000000), ref: 0065CFF2

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: adbc309fbf679163830c905dd2903e6cb9419ed6c34166cd7a6deee3ad5e72f6
Instruction ID: 8ffe38fe3fed598acacfd620aa836ce5b7cdd50d813303ef90028dcfb1bd05ad
Opcode Fuzzy Hash: adbc309fbf679163830c905dd2903e6cb9419ed6c34166cd7a6deee3ad5e72f6
Instruction Fuzzy Hash: 14318E71600305EFDB24DFA5C8849ABBBFAEF04326F10442EF91AD2241DB30AE45DB60

Function 00641901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00641915
PostMessageW.USER32(00000001,00000201,00000001), ref: 006419C1
Sleep.KERNEL32(00000000,?,?,?), ref: 006419C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 006419DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 006419E2

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 6c25f47f27b4a05865179a615d2d1a6d63bf21569b04722e5d984ad5708b530c
Instruction ID: e4d95565871577358cd37adb541c27b07a6ebad367f8c25ad04f48fe10538015
Opcode Fuzzy Hash: 6c25f47f27b4a05865179a615d2d1a6d63bf21569b04722e5d984ad5708b530c
Instruction Fuzzy Hash: BD31B171A00219EFCB04CFA8CD99ADE7BB6FB45325F104229F925AB2D1C7709D94DB90

Function 00675706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00675745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0067579D
_wcslen.LIBCMT ref: 006757AF
_wcslen.LIBCMT ref: 006757BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00675816

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 76ebc7f4f2a8fa591eb7c63fd62bef2fc59101e3255e39206a537e7b77e470de
Instruction ID: d8e8b99ed6590f4e788d79215759aa6fea45b4095a4b226064933d540b023a12
Opcode Fuzzy Hash: 76ebc7f4f2a8fa591eb7c63fd62bef2fc59101e3255e39206a537e7b77e470de
Instruction Fuzzy Hash: 822167719046189ADB249F64CC85AEE77BAFF04724F10C25AE92EDA2C4D7B099C5CF50

Function 00660930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00660951
GetForegroundWindow.USER32 ref: 00660968
GetDC.USER32(00000000), ref: 006609A4
GetPixel.GDI32(00000000,?,00000003), ref: 006609B0
ReleaseDC.USER32(00000000,00000003), ref: 006609E8

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 58b51a7cbfca978752a3e661ab04e6902977e619808d5ec42a19b737581aeebb
Instruction ID: dc4420bba1ac93e9486faa5fc8a583cfcf0d255f482dec2e8e87923209c055bb
Opcode Fuzzy Hash: 58b51a7cbfca978752a3e661ab04e6902977e619808d5ec42a19b737581aeebb
Instruction Fuzzy Hash: B1218135600204AFE708EF65D889AAFBBE6FF45711F04847DE84AA7352DB70AD44CB90

Function 0061CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0061CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0061CDE9

Part of subcall function 00613820: RtlAllocateHeap.NTDLL(00000000,?,006B1444,?,005FFDF5,?,?,005EA976,00000010,006B1440,005E13FC,?,005E13C6,?,005E1129), ref: 00613852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0061CE0F
_free.LIBCMT ref: 0061CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0061CE31

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 3ab61600c60db97104f80acb34b56745f0bd13e5c53352ab9d1bbd05554db82c
Instruction ID: dc71ab20bd146a7632d7dc3be83b423532ae87a226c05b14b2ee4a394dc5ba26
Opcode Fuzzy Hash: 3ab61600c60db97104f80acb34b56745f0bd13e5c53352ab9d1bbd05554db82c
Instruction Fuzzy Hash: 3C01D4726412167FA32116BA6C88CFF6A6FDFC6BB1319012DF909C7300EA608D8281B0

Function 005F9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 005F9693
SelectObject.GDI32(?,00000000), ref: 005F96A2
BeginPath.GDI32(?), ref: 005F96B9
SelectObject.GDI32(?,00000000), ref: 005F96E2

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 7fd90318f48531e025c9ece3c199c140a20fe5f2ac1596a0a6a3c79aadca430e
Instruction ID: 9e5a7f7bc24168a74a3f7c4341f979f516abf45f640d1a10138989932d40f161
Opcode Fuzzy Hash: 7fd90318f48531e025c9ece3c199c140a20fe5f2ac1596a0a6a3c79aadca430e
Instruction Fuzzy Hash: 58216DB0802749EBDB11AF64DC287B93FAABB42325F50131AF514AA1A0D37458D1CBD4

Function 00645711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00645726
_memcmp.LIBVCRUNTIME ref: 00645744
_memcmp.LIBVCRUNTIME ref: 00645757
_memcmp.LIBVCRUNTIME ref: 0064576F
_memcmp.LIBVCRUNTIME ref: 00645787

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 1fb977fceb44a9096a4d08fd5dc3276827b4064b2f1e125ded22bb16342d2a4d
Instruction ID: fc5177129bb8aa594f7fef73b8f4f11cbcffc8bfa0644fba8984edcdd6e712bd
Opcode Fuzzy Hash: 1fb977fceb44a9096a4d08fd5dc3276827b4064b2f1e125ded22bb16342d2a4d
Instruction Fuzzy Hash: F50156A1681605FBE30C56119E52EFB735FEB61794B008035FD0A9E682FA61ED11C2A5

Function 0064000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?,?,0064035E), ref: 0064002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?), ref: 00640046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?), ref: 00640054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?), ref: 00640064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0063FF41,80070057,?,?), ref: 00640070

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: d061455623b70225c7292aaf39b310feb064beb5069c623b52faabaaaabdd8ed
Instruction ID: f98b46af90432d75a27ec2f3195b35652ccab5d75e4c86ce6f195d3928a9be66
Opcode Fuzzy Hash: d061455623b70225c7292aaf39b310feb064beb5069c623b52faabaaaabdd8ed
Instruction Fuzzy Hash: 78018F72600224BFEB205F68DC04BAA7EAFEB44B61F145128FE09D2210D771DE808BA0

Function 006410F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00641114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 00641120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 0064112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00640B9B,?,?,?), ref: 00641136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0064114D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: c2b80f382bbbc360d8839cc550bb215760239b4bfe28b2ffad36ac8869230c89
Instruction ID: bfcc7d81344c3efc4ab4437181860eb0f3dc43a9274005e34bd17d13f8603163
Opcode Fuzzy Hash: c2b80f382bbbc360d8839cc550bb215760239b4bfe28b2ffad36ac8869230c89
Instruction Fuzzy Hash: 94013175100205BFDB154F65DC49EAA3F6FEF86371B104429FA45D7350DB31DC809A60

Function 00640FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00640FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00640FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00640FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00640FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00641002

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a7847d8ff4e9f0bd7fb37407b11358e78e4d426adbef964cd4fbf011be2b9803
Instruction ID: 4fccbca3123566001e9d8d9a2b3b1a91d9f654b95c3b741a59488730d2abbc85
Opcode Fuzzy Hash: a7847d8ff4e9f0bd7fb37407b11358e78e4d426adbef964cd4fbf011be2b9803
Instruction Fuzzy Hash: 74F04F35100301ABD7254FA4EC49F963FAEEF8A761F504428F949DA251DA71DCC08A60

Function 00641014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0064102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00641036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00641045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0064104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00641062

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 0bdfba85e2e16b1aa98dcfaba56dcb1974f4b62f66e76e8c598fc073933be093
Instruction ID: f9488ac9eb98d2765ce77d699d192b3b32b7da0b600784fbf2fddbd5b24a988d
Opcode Fuzzy Hash: 0bdfba85e2e16b1aa98dcfaba56dcb1974f4b62f66e76e8c598fc073933be093
Instruction Fuzzy Hash: 10F06D35200305EBDB255FA4EC49F963BAFEF8AB71F101428FA49DB250DE71D8D08A60

Function 0065030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0065017D,?,006532FC,?,00000001,00622592,?), ref: 00650324
CloseHandle.KERNEL32(?,?,?,?,0065017D,?,006532FC,?,00000001,00622592,?), ref: 00650331
CloseHandle.KERNEL32(?,?,?,?,0065017D,?,006532FC,?,00000001,00622592,?), ref: 0065033E
CloseHandle.KERNEL32(?,?,?,?,0065017D,?,006532FC,?,00000001,00622592,?), ref: 0065034B
CloseHandle.KERNEL32(?,?,?,?,0065017D,?,006532FC,?,00000001,00622592,?), ref: 00650358
CloseHandle.KERNEL32(?,?,?,?,0065017D,?,006532FC,?,00000001,00622592,?), ref: 00650365

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a85f4adefcce60ada08e231b16cec1da11f837d6756f079ca628601d4429ab76
Instruction ID: 30bf0dcc1917712a6aefec3f9bca9cd342915f64024d0af9887a7c92c9dc5731
Opcode Fuzzy Hash: a85f4adefcce60ada08e231b16cec1da11f837d6756f079ca628601d4429ab76
Instruction Fuzzy Hash: 2501A276800B169FD7309F66D880452F7F6BF503163158A3FD19652A31C371A958CF80

Function 0061D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0061D752

Part of subcall function 006129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000), ref: 006129DE
Part of subcall function 006129C8: GetLastError.KERNEL32(00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000,00000000), ref: 006129F0

_free.LIBCMT ref: 0061D764
_free.LIBCMT ref: 0061D776
_free.LIBCMT ref: 0061D788
_free.LIBCMT ref: 0061D79A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9729a9f2500d616f505115430d8876399883b52d32e7708b1b907bbf0a2fe1e5
Instruction ID: adad8c2635a70d0a92a45ca9f29ce0284791dd33584cd18e18d7e16ac25834c9
Opcode Fuzzy Hash: 9729a9f2500d616f505115430d8876399883b52d32e7708b1b907bbf0a2fe1e5
Instruction Fuzzy Hash: 06F03C32500205ABC661FB69F9C5CDA7BDFBB05B20B9C1C09F048DB651CB24FCD08AA4

Function 00645C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00645C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00645C6F
MessageBeep.USER32(00000000), ref: 00645C87
KillTimer.USER32(?,0000040A), ref: 00645CA3
EndDialog.USER32(?,00000001), ref: 00645CBD

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 48349c30e8d493dd2ca5a54ba5f7b069acb33cedded56d12c44e7544bcdd31ed
Instruction ID: 0c17b2506d09a431c94ccab16d965e4dfb5d20a5975a2668ec2bcaf5babf2635
Opcode Fuzzy Hash: 48349c30e8d493dd2ca5a54ba5f7b069acb33cedded56d12c44e7544bcdd31ed
Instruction Fuzzy Hash: 54018130500B04ABEB395B14DDCEFE67BBABB00B46F00155DA587A10E2DBF0A9848B91

Function 006122A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006122BE

Part of subcall function 006129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000), ref: 006129DE
Part of subcall function 006129C8: GetLastError.KERNEL32(00000000,?,0061D7D1,00000000,00000000,00000000,00000000,?,0061D7F8,00000000,00000007,00000000,?,0061DBF5,00000000,00000000), ref: 006129F0

_free.LIBCMT ref: 006122D0
_free.LIBCMT ref: 006122E3
_free.LIBCMT ref: 006122F4
_free.LIBCMT ref: 00612305

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e8a7a8861ac1d59360451c64e79e3a30926d2fa164d5712d762ec77f28557b9a
Instruction ID: 69cef3b42b0d394e1cd917ced82abd64687e9fa082d605e373a78ae342453e60
Opcode Fuzzy Hash: e8a7a8861ac1d59360451c64e79e3a30926d2fa164d5712d762ec77f28557b9a
Instruction Fuzzy Hash: CCF01DB19101119BC752BF69AC218993F6BF71AB707482A0AF410DB371C7345AF19EA8

Function 005F95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 005F95D4
StrokeAndFillPath.GDI32(?,?,006371F7,00000000,?,?,?), ref: 005F95F0
SelectObject.GDI32(?,00000000), ref: 005F9603
DeleteObject.GDI32 ref: 005F9616
StrokePath.GDI32(?), ref: 005F9631

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: d7fec6c97eeb9f84a79f1a6a5536866bf5824c6d1ba7e36b36750a11ad84327f
Instruction ID: aaee91fd8c1c87a909e68d402b27e29c36821f37fd4ef469be8b6561a68ef07d
Opcode Fuzzy Hash: d7fec6c97eeb9f84a79f1a6a5536866bf5824c6d1ba7e36b36750a11ad84327f
Instruction Fuzzy Hash: 64F0197000564CEBDB266F65ED287A43F66BB02336F54A318F529990F0C73589D1DFA0

Function 00610F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 006110F9
__freea.LIBCMT ref: 00611117

Part of subcall function 00611537: _free.LIBCMT ref: 0061154F

Strings

am/pm, xrefs: 0061117A
a/p, xrefs: 006111DE

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 467747d2646d859a7f9d46eed417ec5e12e14de2786f6ea82647c60fa0f3fb07
Instruction ID: 7dfb9cad61234bfd9ddf9954ac4b091454214d8ee74a653550003ae0e66e519e
Opcode Fuzzy Hash: 467747d2646d859a7f9d46eed417ec5e12e14de2786f6ea82647c60fa0f3fb07
Instruction Fuzzy Hash: 90D1CE31900206DADB289F68C856AFAB7B3EF07300F2C415AEB219F754D6759EC1CB95

Function 006661D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00600242: EnterCriticalSection.KERNEL32(006B070C,006B1884,?,?,005F198B,006B2518,?,?,?,005E12F9,00000000), ref: 0060024D
Part of subcall function 00600242: LeaveCriticalSection.KERNEL32(006B070C,?,005F198B,006B2518,?,?,?,005E12F9,00000000), ref: 0060028A

Part of subcall function 006000A3: __onexit.LIBCMT ref: 006000A9

__Init_thread_footer.LIBCMT ref: 00666238

Part of subcall function 006001F8: EnterCriticalSection.KERNEL32(006B070C,?,?,005F8747,006B2514), ref: 00600202
Part of subcall function 006001F8: LeaveCriticalSection.KERNEL32(006B070C,?,005F8747,006B2514), ref: 00600235

Part of subcall function 0065359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 006535E4
Part of subcall function 0065359C: LoadStringW.USER32(006B2390,?,00000FFF,?), ref: 0065360A

Strings

x#k, xrefs: 00666353
x#k, xrefs: 0066636F
x#k, xrefs: 0066633A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#k$x#k$x#k
API String ID: 1072379062-2300618980
Opcode ID: e604f8d232e0b875b262d17ae9e4d6d17efd72ca16f2b8bebffefb0936789738
Instruction ID: ca09311702f9bbbd4be047ee805ada3e3506914ea79ef251ded06fbad67b5322
Opcode Fuzzy Hash: e604f8d232e0b875b262d17ae9e4d6d17efd72ca16f2b8bebffefb0936789738
Instruction Fuzzy Hash: 8BC14E71A0010AABDB14DF58D895EBEBBBAFF48300F148069F955AB391DB70ED45CB90

Function 00615AA9 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

JO^, xrefs: 00615BA8, 00615C6C

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID: JO^
API String ID: 0-2038365757
Opcode ID: 2e31778bce15687bd41f082879d7c053cee31debbfd5307ffe4a2f450957c24f
Instruction ID: dd11430e445cbace75fc3e23e3ff87ae1b8c5fc2c4cbd69209f81aa8048198dc
Opcode Fuzzy Hash: 2e31778bce15687bd41f082879d7c053cee31debbfd5307ffe4a2f450957c24f
Instruction Fuzzy Hash: 3B51B171D04609DFDB249FA4C845FEFFBBAAF85310F18005DF406A72A1D7719A828BA5

Function 00618A61 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000002,00000000,?,?,?,00000000,?,?,?,?), ref: 00618B6E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00000000,00001000,?), ref: 00618B7A
__dosmaperr.LIBCMT ref: 00618B81

Strings

.`, xrefs: 00618A63

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: .`
API String ID: 2434981716-3826532246
Opcode ID: 3d50129f5baa54fed2b6f625302554e0af4bf9c9ef2a805d53ab2fa491c7b882
Instruction ID: c430f020dcb7cb5767fc4c217096c82dc98253f07d50c60f9228580de2107ec3
Opcode Fuzzy Hash: 3d50129f5baa54fed2b6f625302554e0af4bf9c9ef2a805d53ab2fa491c7b882
Instruction Fuzzy Hash: 1D415BB0608145AFDB249F64CC90AFA7FA7DF86314B2C81A9F88587652DE318D839794

Function 00642716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0064B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006421D0,?,?,00000034,00000800,?,00000034), ref: 0064B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00642760

Part of subcall function 0064B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006421FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0064B3F8

Part of subcall function 0064B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0064B355
Part of subcall function 0064B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00642194,00000034,?,?,00001004,00000000,00000000), ref: 0064B365
Part of subcall function 0064B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00642194,00000034,?,?,00001004,00000000,00000000), ref: 0064B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006427CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0064281A

Strings

@, xrefs: 00642832

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: e78ab0bcd6bb4f77c80f46716e88b703592ce9ee32e34946d9c5b7212ef9f9bf
Instruction ID: d9d95cd931d8f142ce89bd52a5131212327b4ec47a29b6c3fb3a3782db96cf91
Opcode Fuzzy Hash: e78ab0bcd6bb4f77c80f46716e88b703592ce9ee32e34946d9c5b7212ef9f9bf
Instruction Fuzzy Hash: 01416072900219BFDB10DFA4CC95ADEBBB9EF05300F105099FA45B7181DB70AE85CBA0

Function 0061172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00611769
_free.LIBCMT ref: 00611834
_free.LIBCMT ref: 0061183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00611760, 00611767, 00611796, 006117CE

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: 61baab82a15f6e6f960228eedea70def25698cc1e667dd2dcc95bdaf0d14fbfc
Instruction ID: 7af98c47817335dabc068cf1c669ceaad8cceddd010a6c8028dac2de052c4eec
Opcode Fuzzy Hash: 61baab82a15f6e6f960228eedea70def25698cc1e667dd2dcc95bdaf0d14fbfc
Instruction Fuzzy Hash: EB318071A00218BFDB61DF999881DDEBBFEEB86310B58416AF504DB351D6708EC1CB94

Function 0064C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0064C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0064C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,006B1990,013A5268), ref: 0064C395

Strings

0, xrefs: 0064C2DF

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 6b33575362f321bc715e7fababb731cbf5ae80fcd655691a721e98cb4f6e3e4a
Instruction ID: ad5a3a39889be6d09ed182753f50f9eb5dba18cf7830f95116af7a933ad59171
Opcode Fuzzy Hash: 6b33575362f321bc715e7fababb731cbf5ae80fcd655691a721e98cb4f6e3e4a
Instruction Fuzzy Hash: 1741DF322063029FD765DF25D884F5ABBEAAF85320F008A1DF9A5973D1D730E904CB66

Function 00674416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0067CC08,00000000,?,?,?,?), ref: 006744AA
GetWindowLongW.USER32 ref: 006744C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 006744D7

Strings

SysTreeView32, xrefs: 0067447C

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 9e1eb395ed40798869e2491e67e9498fe2fad138fef7ba8f5040875325359982
Instruction ID: f9c0c6cb5e959f05ca5d2bd5264cbc943b7c1efa49135bd4ea5a70a1ece59376
Opcode Fuzzy Hash: 9e1eb395ed40798869e2491e67e9498fe2fad138fef7ba8f5040875325359982
Instruction Fuzzy Hash: 6F31B271210605AFDF148E38DC49BEA7BAAEB48334F208715F979922D0DB74EC909750

Function 00646E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00646EED
VariantCopyInd.OLEAUT32(?,?), ref: 00646F08
VariantClear.OLEAUT32(?), ref: 00646F12

Strings

*jd, xrefs: 00646E8B, 00646E90, 00646EF8

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *jd
API String ID: 2173805711-525745224
Opcode ID: beb2d3e14603117d2481f8107943a5479f7c456e19cd498b771088325e0ede0c
Instruction ID: ce18807a10acd3f8271dba1d45f98458e60e19b21a0be7093dac7b2ca525f191
Opcode Fuzzy Hash: beb2d3e14603117d2481f8107943a5479f7c456e19cd498b771088325e0ede0c
Instruction Fuzzy Hash: 1231B371604246DFCB08AF66E8959BE3BB7FF86300F100499F9824B2B1C7349916DBD2

Function 0066304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0066335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00663077,?,?), ref: 00663378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0066307A
_wcslen.LIBCMT ref: 0066309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00663106

Strings

255.255.255.255, xrefs: 00663095, 0066309A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: d63c04404ebe8cfdb0542c2e491aeb6b1f2336ff37224fa90b216db1411dff6a
Instruction ID: 23fb94b657c78c34c1a424e2fd65bf24387aab440371d5464452f8eb8e8920fc
Opcode Fuzzy Hash: d63c04404ebe8cfdb0542c2e491aeb6b1f2336ff37224fa90b216db1411dff6a
Instruction Fuzzy Hash: 9331E4356042519FCB24CF28C585EAABBE2EF55318F248059E9158F392DB32EF85CB61

Function 00673EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00673F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00673F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00673F78

Strings

SysMonthCal32, xrefs: 00673F0B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: b043e4069ec8a2d97ebf400b75862b25e8da4b88ec09e2239a10c707c8aee8e2
Instruction ID: 247454510c396b3d8d2e816daca26346276a872c35c88485b56073ddf60abf55
Opcode Fuzzy Hash: b043e4069ec8a2d97ebf400b75862b25e8da4b88ec09e2239a10c707c8aee8e2
Instruction Fuzzy Hash: F721BF32600229BFDF159F50CC46FEA3B76EF48764F114218FA196B2D0D6B5AD909B90

Function 00674653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00674705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00674713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0067471A

Strings

msctls_updown32, xrefs: 00674684

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: c0f0ad259a40b7ce8ad0fee66d736c26a5c8ec45cb552b775e5d6c8b902a6fbf
Instruction ID: 59085586528133c79ee86495b108a4769958ef2ba91cfdd4dc48bf10f869b20c
Opcode Fuzzy Hash: c0f0ad259a40b7ce8ad0fee66d736c26a5c8ec45cb552b775e5d6c8b902a6fbf
Instruction Fuzzy Hash: 32219DB5600209BFEB14DF64DCD5DA737AEEF8A3A4B004149FA049B391DB30EC51CA60

Function 006495AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0064961D

Strings

#notrayicon, xrefs: 006495B7
#requireadmin, xrefs: 006495D9
#OnAutoItStartRegister, xrefs: 006495F3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: c66fc2da7885d91ad7d097558b38e7f1ae9d740b786f5449ae74db603d7668b8
Instruction ID: 8fbd195841f45f705241eb23f3bac66f04ce5e76eced974eea6427cbfdeab10e
Opcode Fuzzy Hash: c66fc2da7885d91ad7d097558b38e7f1ae9d740b786f5449ae74db603d7668b8
Instruction Fuzzy Hash: B5215B7218411166D335AB25EC06FF773DBEF95320F11842AF98997282EB519D42C2F5

Function 006737B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00673840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00673850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00673876

Strings

Listbox, xrefs: 0067380F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 020c324ed92966099e2f551c26917350561d47b22e1356428ed00ba8852311a6
Instruction ID: 43e1100c3580827ba9c3933a70cae4e0a2752bb563260bbb263032ac6ad27028
Opcode Fuzzy Hash: 020c324ed92966099e2f551c26917350561d47b22e1356428ed00ba8852311a6
Instruction Fuzzy Hash: 2621B072610228BBEB158F54CC85EEB376FEF89760F108114F9489B290C672DC529BA0

Function 006549F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00654A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00654A5C
SetErrorMode.KERNEL32(00000000,?,?,0067CC08), ref: 00654AD0

Strings

%lu, xrefs: 00654A6F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 5e57f9d13b880da3dfb2db88ce1fe477a04e41c66f1e86bce146ebe0471c06d7
Instruction ID: f2aa75cecc1c36fe34f0fb6792e7e8641126f9101001f5a95f6fd524d7d4b590
Opcode Fuzzy Hash: 5e57f9d13b880da3dfb2db88ce1fe477a04e41c66f1e86bce146ebe0471c06d7
Instruction Fuzzy Hash: 76318070A00109AFDB14DF54C885EAA7BF9EF48308F1480A9F809DB252DB71ED85CB61

Function 006741EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0067424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00674264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00674271

Strings

msctls_trackbar32, xrefs: 00674226

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 72c5fd585f12144eca8fe618d9bc35801793b0ab3e76dfa8b67c3a9189addff2
Instruction ID: b02f9435c15687c6f684afe26a3f51ba42a22ff56f62da6f84a4b4da102da93e
Opcode Fuzzy Hash: 72c5fd585f12144eca8fe618d9bc35801793b0ab3e76dfa8b67c3a9189addff2
Instruction Fuzzy Hash: 6211E331240248BEEF209F29CC0AFEB3BAEEF95B64F114518FA59E6190D671DC619B14

Function 00642F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

Part of subcall function 00642DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00642DC5
Part of subcall function 00642DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00642DD6
Part of subcall function 00642DA7: GetCurrentThreadId.KERNEL32 ref: 00642DDD
Part of subcall function 00642DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00642DE4

GetFocus.USER32 ref: 00642F78

Part of subcall function 00642DEE: GetParent.USER32(00000000), ref: 00642DF9

GetClassNameW.USER32(?,?,00000100), ref: 00642FC3
EnumChildWindows.USER32(?,0064303B), ref: 00642FEB

Strings

%s%d, xrefs: 00642FFF

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 8a6a179264345e0a51e69b57f60fd73a3252e16ce278305e900c1711ece72c78
Instruction ID: 21baf48523a0cadb318061478b2c9f64a7cbd15ac982d1256f7a13f973f276de
Opcode Fuzzy Hash: 8a6a179264345e0a51e69b57f60fd73a3252e16ce278305e900c1711ece72c78
Instruction Fuzzy Hash: AF11D3716002166BCF55BF708CD9EEE3BABAF94354F148079F9099B292DE309949CB70

Function 00675882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 006758C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 006758EE
DrawMenuBar.USER32(?), ref: 006758FD

Strings

0, xrefs: 0067588F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 2187673772e3c4dd76ce6d62918adf7bda553b10bd7bf91b0eb652a628ef688f
Instruction ID: 5965ed9a1c55ea712a6e1334a5ef23368f662a70ee09d7f7bb75ce0c641bfd48
Opcode Fuzzy Hash: 2187673772e3c4dd76ce6d62918adf7bda553b10bd7bf91b0eb652a628ef688f
Instruction Fuzzy Hash: 4A018E31500209EFDB109F11DC44BAEBBBAFF45360F10C099EA4EDA251DB708A94DF20

Function 0063D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0063D3BF
FreeLibrary.KERNEL32 ref: 0063D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0063D3B9
X64, xrefs: 0063D2A8

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: e24ff6de36a6e9e347d0423e1c13ba5f7d102a4d253cb944ec0d709079feb4c2
Instruction ID: 959eb47990f04f8f5dc28ab22a1e7bdffc217ded409762cb5f74aeaf68e6373b
Opcode Fuzzy Hash: e24ff6de36a6e9e347d0423e1c13ba5f7d102a4d253cb944ec0d709079feb4c2
Instruction Fuzzy Hash: E9F0A371C01520D7E37117105C189EE3717AF12711F94802DF905E2204EB30CF8087D2

Function 0064007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b8fe06ab486e2ba927d76fb9cbe47fcd401fc7637c64727336e4b0ea9fae29
Instruction ID: d2a426c42cddbb6d8537683118016383a75eadc8676e960ebf322113d24954f2
Opcode Fuzzy Hash: 66b8fe06ab486e2ba927d76fb9cbe47fcd401fc7637c64727336e4b0ea9fae29
Instruction Fuzzy Hash: BDC16F75A00226EFDB15CFA4C894EAEBBB6FF48704F108598E505EB251D771EE41CB90

Function 0066342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00663459
CoUninitialize.OLE32 ref: 00663463
VariantInit.OLEAUT32(?), ref: 0066346E
VariantClear.OLEAUT32(?), ref: 0066371B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: ef9042534c6100b2f33ace6becce3f0ae4437229268b46499f37c7abc426df80
Instruction ID: aabf1d184f5d054a21d21d26c6ac58520b7f69a4103156c3daa53c5cde581df9
Opcode Fuzzy Hash: ef9042534c6100b2f33ace6becce3f0ae4437229268b46499f37c7abc426df80
Instruction Fuzzy Hash: CBA139756047159FC714DF29C489A2ABBE6FF88714F04885DF98A9B362DB30EE01CB91

Function 00640436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0067FC08,?), ref: 006405F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0067FC08,?), ref: 00640608
CLSIDFromProgID.OLE32(?,?,00000000,0067CC40,000000FF,?,00000000,00000800,00000000,?,0067FC08,?), ref: 0064062D
_memcmp.LIBVCRUNTIME ref: 0064064E

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 7ebc5943ea48d64f9b28b5a94f636537c0ca0db9c8300297546038df41164feb
Instruction ID: 83beed4765d24c7e91afa090886da7bbf39534fdc64ea48ce00d799a22d9bb05
Opcode Fuzzy Hash: 7ebc5943ea48d64f9b28b5a94f636537c0ca0db9c8300297546038df41164feb
Instruction Fuzzy Hash: EC812C71A00119EFDB04DF94C984DEEB7BAFF89315F204598E606AB250DB71AE06CF60

Function 00621391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006214C0

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f8de659a8ca97ff9327c6cb96dcef1bd2af8ce6e069f5bb2704066a059ef83af
Instruction ID: 1a3b823e5d6ab8d6f5cbd79ec3aa1f4bb9078889e14845373d639a611297c0c3
Opcode Fuzzy Hash: f8de659a8ca97ff9327c6cb96dcef1bd2af8ce6e069f5bb2704066a059ef83af
Instruction Fuzzy Hash: D1415B31504920ABDB257FF8AC456EF3AE7EF63370F144229F41CDA2D1E63049815B65

Function 00676278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 006762E2
ScreenToClient.USER32(?,?), ref: 00676315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00676382

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: a27aaaed852cb627d208c20bca246e77b65c103db573936cd25ee41accffd3e8
Instruction ID: 4012ba3ca8fd9a4b3075d30e735ad3221b299dd784d68ec14a647f97232cb862
Opcode Fuzzy Hash: a27aaaed852cb627d208c20bca246e77b65c103db573936cd25ee41accffd3e8
Instruction Fuzzy Hash: 77511A74A00649EFDB14DF68D8809EE7BB6FF45360F109259F8299B390D730AE81CB90

Function 00661AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00661AFD
WSAGetLastError.WSOCK32 ref: 00661B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00661B8A
WSAGetLastError.WSOCK32 ref: 00661B94

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 17412b468d480faec5ca850f5d3a460db91584cac3cd87dfb89dcd45bd3dbd5f
Instruction ID: 81c0c529ef3c05d577bdf5f4ab7dd1237a12a66699e99686dc634feb213dd086
Opcode Fuzzy Hash: 17412b468d480faec5ca850f5d3a460db91584cac3cd87dfb89dcd45bd3dbd5f
Instruction Fuzzy Hash: 1841B6346002016FD7249F24C88AF757BE6AB85718F58845CF6599F3D3D771DD428B90

Function 0061B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f3d1205506088f2572c26bdc6738fdf6934319665522ad7061c0e607cc5aff
Instruction ID: c63437dd284e0a9c27458137725a371d1077e0c90fce70387a12804e04036706
Opcode Fuzzy Hash: 58f3d1205506088f2572c26bdc6738fdf6934319665522ad7061c0e607cc5aff
Instruction Fuzzy Hash: C2410671A00714AFD7249F78CC41BEABBEBEF88710F14852EF141DB692D77199818B94

Function 006556D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00655783
GetLastError.KERNEL32(?,00000000), ref: 006557A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 006557CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 006557FA

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 95ea5ccbe0a9c4f5d8135523674204288bf4c88f5fb549093a3c8e6fbc59ece1
Instruction ID: 6b50ed600fd6925702400f6d09799db1d0666c894b8fb7b8e478780884d475d7
Opcode Fuzzy Hash: 95ea5ccbe0a9c4f5d8135523674204288bf4c88f5fb549093a3c8e6fbc59ece1
Instruction Fuzzy Hash: DA413B35600A51DFCB14DF15C448A5EBBE2BF89321F188489EC9AAB362DB30FD45CB91

Function 0061D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,00606D71,00000000,00000000,006082D9,?,006082D9,?,00000001,00606D71,?,00000001,006082D9,006082D9), ref: 0061D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0061D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0061D9AB
__freea.LIBCMT ref: 0061D9B4

Part of subcall function 00613820: RtlAllocateHeap.NTDLL(00000000,?,006B1444,?,005FFDF5,?,?,005EA976,00000010,006B1440,005E13FC,?,005E13C6,?,005E1129), ref: 00613852

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 293f179e5d5a32d97edaeb2be5b9bc11781d01c3252e3f72ede56bc74f829818
Instruction ID: 758a278a6292f505819a31f3d62841b1fa2285064ee13e59612b4e8b4095fa2b
Opcode Fuzzy Hash: 293f179e5d5a32d97edaeb2be5b9bc11781d01c3252e3f72ede56bc74f829818
Instruction Fuzzy Hash: 9131A072A0021AABDB289F64DC45EEF7BA6EB41310B094568FC04D6290EB35DD91CBA0

Function 006752C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00675352
GetWindowLongW.USER32(?,000000F0), ref: 00675375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00675382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006753A8

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 46d081160e1b4f12d69ad72e17a4eacb9e5c0e33184cd3747041ee22cf01f718
Instruction ID: 0c43934bacdf30703ada53bef2289d6dd3bb7a4a8342307775e593dbbe38a60b
Opcode Fuzzy Hash: 46d081160e1b4f12d69ad72e17a4eacb9e5c0e33184cd3747041ee22cf01f718
Instruction Fuzzy Hash: 25310630A55A08FFEB349B14CC55BE83767AB043B0F548185FA1A963F0E7F4AD809781

Function 0064AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 0064ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0064AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0064AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 0064ACC6

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 19a46650ecbc6a5dcaba42246375a677c5d29272ea5667970078151c4000b055
Instruction ID: d7cfe4baedf9dbfe0c824ff3beda9d6860e4b6bbcfcb70e81704007faba93226
Opcode Fuzzy Hash: 19a46650ecbc6a5dcaba42246375a677c5d29272ea5667970078151c4000b055
Instruction Fuzzy Hash: 5E310870A80618BFEF75CBA58C847FA7BA7AB49320F04521EE485562D1C37589858792

Function 00677674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0067769A
GetWindowRect.USER32(?,?), ref: 00677710
PtInRect.USER32(?,?,00678B89), ref: 00677720
MessageBeep.USER32(00000000), ref: 0067778C

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: a104a83d06473a98ce01bbb4f83851124414857080bc88382f11eb5392c22423
Instruction ID: 50c13cbdd93ca9436c70f0cc1fc2b46d47d95f96bde0a2c709d438afbb5ba2b9
Opcode Fuzzy Hash: a104a83d06473a98ce01bbb4f83851124414857080bc88382f11eb5392c22423
Instruction Fuzzy Hash: 5641AD74605254EFCB19DF58D894EA9B7F6FB49314F1881A8E4189F361C331AA82CF90

Function 006716DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 006716EB

Part of subcall function 00643A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00643A57
Part of subcall function 00643A3D: GetCurrentThreadId.KERNEL32 ref: 00643A5E
Part of subcall function 00643A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,006425B3), ref: 00643A65

GetCaretPos.USER32(?), ref: 006716FF
ClientToScreen.USER32(00000000,?), ref: 0067174C
GetForegroundWindow.USER32 ref: 00671752

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 17cf2627108d825fece89f87e4ea6d2b96483c78570f3a8c3f3aa80da4541dc0
Instruction ID: 3d6a76ed2028b21b9fbb3d2a66740cc7fddba663211e0454ef8e6f35ce5d9225
Opcode Fuzzy Hash: 17cf2627108d825fece89f87e4ea6d2b96483c78570f3a8c3f3aa80da4541dc0
Instruction Fuzzy Hash: ED313071D00149AFCB04DFAAC885CAEBBFAFF89304B54806AE455E7311D631DE45CBA0

Function 0064D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0064D501
Process32FirstW.KERNEL32(00000000,?), ref: 0064D50F
Process32NextW.KERNEL32(00000000,?), ref: 0064D52F
CloseHandle.KERNEL32(00000000), ref: 0064D5DC

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 4bbd79181420c3dd7bfc61b0ffb7029a469bea64f2af652a461ed5473756cb23
Instruction ID: adbdd860daf8e35e30004244bac3a16776e0b2317536cc42f9ae26d1b9b863d6
Opcode Fuzzy Hash: 4bbd79181420c3dd7bfc61b0ffb7029a469bea64f2af652a461ed5473756cb23
Instruction Fuzzy Hash: 6631B1311083419FD308EF64C885AAFBFE9FFD9354F50092DF585822A1EB719985CB92

Function 00678FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

GetCursorPos.USER32(?), ref: 00679001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00637711,?,?,?,?,?), ref: 00679016
GetCursorPos.USER32(?), ref: 0067905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00637711,?,?,?), ref: 00679094

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 22dea7e6eea7351f5f070a030d779484a27c7b1d82322f38007e8c57f4f56722
Instruction ID: faa70bc45f9eb97298c79000f6b057ae8ab7791932a76e17ed6f9820bb007ad6
Opcode Fuzzy Hash: 22dea7e6eea7351f5f070a030d779484a27c7b1d82322f38007e8c57f4f56722
Instruction Fuzzy Hash: 0A217F35610018FFDB298F94CC58EFA7BFAFB8A360F148159F9094B261C73599A0DB60

Function 0064D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0067CB68), ref: 0064D2FB
GetLastError.KERNEL32 ref: 0064D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0064D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0067CB68), ref: 0064D376

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: f92f93915c118a837e3e501d81bcf3fb7710bf772af40b7921aad4cbb67ef8d0
Instruction ID: 0ed4cece413724b721badaf40d4f2d8bb5d94e165fc022e9733c8b158322fcd8
Opcode Fuzzy Hash: f92f93915c118a837e3e501d81bcf3fb7710bf772af40b7921aad4cbb67ef8d0
Instruction Fuzzy Hash: 5C218070908201DFC714DF24C8854AA7BE5AF96724F504A5DF499D32A1EB30DA46CB93

Function 00641571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00641014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0064102A
Part of subcall function 00641014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00641036
Part of subcall function 00641014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00641045
Part of subcall function 00641014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0064104C
Part of subcall function 00641014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00641062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 006415BE
_memcmp.LIBVCRUNTIME ref: 006415E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00641617
HeapFree.KERNEL32(00000000), ref: 0064161E

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: e756f53b138f73b75f92cf1294f16833d57e0e5c0c46bbe145dc98bc0d07802f
Instruction ID: a3abca4d5e98c849581468bc6766841b23f724d7e1a132ef2a0b7feaf6f8c97c
Opcode Fuzzy Hash: e756f53b138f73b75f92cf1294f16833d57e0e5c0c46bbe145dc98bc0d07802f
Instruction Fuzzy Hash: 5D21AF71E00108EFDF04DFA4C945BEEBBBAEF45354F094459E445AB241E731EA85DBA0

Function 00672782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0067280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00672824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00672832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00672840

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: d2444758b5b6941b9e8af9bac959f3dd44ee9adfe34ff5df302b6d4c66f75d1d
Instruction ID: 8450553373e0d2cebbe41c1c2e220f052570c34e5da379100376666a96f1a924
Opcode Fuzzy Hash: d2444758b5b6941b9e8af9bac959f3dd44ee9adfe34ff5df302b6d4c66f75d1d
Instruction Fuzzy Hash: 1C21B631604512AFE718DB24C855FAA7B96FF85324F14815CF42A8B6D2C772FC82C791

Function 006478F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00648D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0064790A,?,000000FF,?,00648754,00000000,?,0000001C,?,?), ref: 00648D8C
Part of subcall function 00648D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00648DB2
Part of subcall function 00648D7D: lstrcmpiW.KERNEL32(00000000,?,0064790A,?,000000FF,?,00648754,00000000,?,0000001C,?,?), ref: 00648DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00648754,00000000,?,0000001C,?,?,00000000), ref: 00647923
lstrcpyW.KERNEL32(00000000,?), ref: 00647949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00648754,00000000,?,0000001C,?,?,00000000), ref: 00647984

Strings

cdecl, xrefs: 0064797B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: aa7a4c95187e30f67a67c47b3ec523eac0baee09061446bf480da1d9822b89c2
Instruction ID: f4febaff1e0bcb676ab87b9aa9e5869b10b83673e8fbbd7f6eb4278ca07e181d
Opcode Fuzzy Hash: aa7a4c95187e30f67a67c47b3ec523eac0baee09061446bf480da1d9822b89c2
Instruction Fuzzy Hash: A611E63A200342AFCB15AF34D845DBA77AAFF95350B50402EF946CB3A4EB319851C7A1

Function 00677CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00677D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00677D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00677D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0065B7AD,00000000), ref: 00677D6B

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 8b76c30c845bfa7baea476f4792858c563a540171059ee797ef75ea7e5cd37e0
Instruction ID: 6d55fa450b070ecba4679b37141f16f4a6df0ad98b0a226cd0c7621044b1631d
Opcode Fuzzy Hash: 8b76c30c845bfa7baea476f4792858c563a540171059ee797ef75ea7e5cd37e0
Instruction Fuzzy Hash: 3511A271514655AFCB209F68CC04AA63BA6BF46374B158728F83DDB2F0D73199A1CB90

Function 00675660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 006756BB
_wcslen.LIBCMT ref: 006756CD
_wcslen.LIBCMT ref: 006756D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00675816

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 86c77a28ba11ed931865fab504c15359541159a910342aac2a43242119e677f3
Instruction ID: ad670325172a6f9caa77d4f34fc8d6fee5ac6820be1c0450675a69e692558a1c
Opcode Fuzzy Hash: 86c77a28ba11ed931865fab504c15359541159a910342aac2a43242119e677f3
Instruction Fuzzy Hash: 2711DA7160061896DF209F61CC85AEE77ADEF11760F50C1AAFA1ED6181E7B0D580CF64

Function 00611D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b253a62157e5f352738a115ac42011ecfddf782e65ebe09f9ec793a2e44c66
Instruction ID: e6daa1c15baf6fa2515e9329aefb771cd1c5cfac6af71df620a344861b06d521
Opcode Fuzzy Hash: a6b253a62157e5f352738a115ac42011ecfddf782e65ebe09f9ec793a2e44c66
Instruction Fuzzy Hash: D301A2B2A096163EF75116787CC1FE7661FDF827B8B38132AF621592D2DB608CD05164

Function 00641A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00641A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00641A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00641A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00641A8A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 88236d1c2973702af985606ead5fcbb7996019f6373b0cd36ca7f185fc7a80de
Instruction ID: a0297295443cd75547e90ee043316cc91b3a25baee2c34e42c1480ba1f029a28
Opcode Fuzzy Hash: 88236d1c2973702af985606ead5fcbb7996019f6373b0cd36ca7f185fc7a80de
Instruction Fuzzy Hash: 3F113C3AD01219FFEB10DBA4CD85FADBB79EB04750F200495E604B7290D6716E90DB94

Function 0064E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0064E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0064E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0064E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0064E24D

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 3547d9da5413dc274d91a6d43fe10a878b69125a7cc6abeb25ea6f90fbe0291f
Instruction ID: 148b93db52b80a65c154e6875ba4623f234d434dd265391e12b2f71d1d4cd137
Opcode Fuzzy Hash: 3547d9da5413dc274d91a6d43fe10a878b69125a7cc6abeb25ea6f90fbe0291f
Instruction Fuzzy Hash: D01108B2904214BBC7059BA89C15ADF7FEEAB45320F404329F915E3291E6B18A4087A0

Function 0060D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0060CFF9,00000000,00000004,00000000), ref: 0060D218
GetLastError.KERNEL32 ref: 0060D224
__dosmaperr.LIBCMT ref: 0060D22B
ResumeThread.KERNEL32(00000000), ref: 0060D249

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 366a7ea5af6546f6f2d901dafa4a03ad0677d7e542b91c3b1ae23c21290a7519
Instruction ID: 3d9f32faf373d841859d8182b43611f667001cc633000b8c4f25b6081decc24b
Opcode Fuzzy Hash: 366a7ea5af6546f6f2d901dafa4a03ad0677d7e542b91c3b1ae23c21290a7519
Instruction Fuzzy Hash: 8101C036885204BBDB296BE5DC09BAB7A6BDF81730F10031DFA29961D0DF708A41C7A0

Function 00679EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 005F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 005F9BB2

GetClientRect.USER32(?,?), ref: 00679F31
GetCursorPos.USER32(?), ref: 00679F3B
ScreenToClient.USER32(?,?), ref: 00679F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00679F7A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: da14bd789c6dd7b1a749e7178b8c1f7901c198384c4a6f5f1fbb809bde7e4a37
Instruction ID: 4f2826ce54813993cd3312c148457222df3b30942e6acc8a1eb486b223115c2e
Opcode Fuzzy Hash: da14bd789c6dd7b1a749e7178b8c1f7901c198384c4a6f5f1fbb809bde7e4a37
Instruction Fuzzy Hash: D4119A3290051ABBDB14EF68C889DEE77BAFB05311F008459F905E3140D334BA91CBB1

Function 005E600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 005E604C
GetStockObject.GDI32(00000011), ref: 005E6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 005E606A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 8766fa1328682df51ecbbe5235eeb744788178b755f8e5463de750d3383ddfa7
Instruction ID: 2e2511e00f173ed24f91db08ebb2f633980194e489ca2475acfbe75456217f13
Opcode Fuzzy Hash: 8766fa1328682df51ecbbe5235eeb744788178b755f8e5463de750d3383ddfa7
Instruction Fuzzy Hash: 2611A173501558BFEF1A9FA59C58EEA7F6AFF183E4F001215FA0452010C732ACA0DB91

Function 00603B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00603B56

Part of subcall function 00603AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00603AD2
Part of subcall function 00603AA3: ___AdjustPointer.LIBCMT ref: 00603AED

_UnwindNestedFrames.LIBCMT ref: 00603B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00603B7C
CallCatchBlock.LIBVCRUNTIME ref: 00603BA4

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 17dd6a0f2ac6bc6aaec403dc518c93f01a195016322d95b491e7440bbfa302e2
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: D0018C72140148BBCF166E95CC42EEB3F6EEF98759F044008FE0856261C732E961DBA4

Function 00613073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,005E13C6,00000000,00000000,?,0061301A,005E13C6,00000000,00000000,00000000,?,0061328B,00000006,FlsSetValue), ref: 006130A5
GetLastError.KERNEL32(?,0061301A,005E13C6,00000000,00000000,00000000,?,0061328B,00000006,FlsSetValue,00682290,FlsSetValue,00000000,00000364,?,00612E46), ref: 006130B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0061301A,005E13C6,00000000,00000000,00000000,?,0061328B,00000006,FlsSetValue,00682290,FlsSetValue,00000000), ref: 006130BF

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 4726c1fcac142d75aa5e6459f35204fa1ba1f9f816cdf5617e7d7b8faad505b9
Instruction ID: f05bca7425851dcc664940a568c90d370c1dd626f5413accd4cf6b340b33fd3f
Opcode Fuzzy Hash: 4726c1fcac142d75aa5e6459f35204fa1ba1f9f816cdf5617e7d7b8faad505b9
Instruction Fuzzy Hash: CC01D832301632ABD7214B799C449D77BDA9F09772B150624F91BE7340D721DA81C7E0

Function 00647464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0064747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00647497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 006474AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 006474CA

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: e4c5dbc91632f22bc78175acb88ecdc398193265fdb763829054963be5557e34
Instruction ID: 9256ecd75a093bd99d5c5936ba612b4d48123a90f470f43536391b77282cf462
Opcode Fuzzy Hash: e4c5dbc91632f22bc78175acb88ecdc398193265fdb763829054963be5557e34
Instruction Fuzzy Hash: 2211ADB1205314ABE720CF24DC08BA27BFEEB00B10F10856DE61AD6191D7B0E944DBA0

Function 0064B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0064ACD3,?,00008000), ref: 0064B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0064ACD3,?,00008000), ref: 0064B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0064ACD3,?,00008000), ref: 0064B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0064ACD3,?,00008000), ref: 0064B126

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 8942aa9869c7ce20b72d456734edf86d09d9428b5c6677f6cf1da9a2ffa751e8
Instruction ID: 8e264d3dbea6274315dee880d1cc63a7d9ab3d3c5a79174af2a9216390a78d0c
Opcode Fuzzy Hash: 8942aa9869c7ce20b72d456734edf86d09d9428b5c6677f6cf1da9a2ffa751e8
Instruction Fuzzy Hash: 7E115B31C0152DEBCF08AFE4E9596EEBB7AFF4A721F105099D941B3281CB309651CB51

Function 00677E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00677E33
ScreenToClient.USER32(?,?), ref: 00677E4B
ScreenToClient.USER32(?,?), ref: 00677E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00677E8A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 810f1ff83f9a45c474703220dc62c521dd4b0003ba32e38c743459ee36826b97
Instruction ID: cbb00be72dc5106997993a8e1d77f6d56453504f0406a39938f4a78bde6c0a30
Opcode Fuzzy Hash: 810f1ff83f9a45c474703220dc62c521dd4b0003ba32e38c743459ee36826b97
Instruction Fuzzy Hash: A51156B9D0020AAFDB41DF98D8849EEBBF5FF18310F509056E915E3210D735AA94CF51

Function 00642DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00642DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00642DD6
GetCurrentThreadId.KERNEL32 ref: 00642DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00642DE4

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 65409767d2d93c5636fc97562b3b15cbca871a01546ee8a7202233c88d1addb6
Instruction ID: 8576f7343c2893ba23577501087e878647310d7284fadfca2d8c9328ffd90e0c
Opcode Fuzzy Hash: 65409767d2d93c5636fc97562b3b15cbca871a01546ee8a7202233c88d1addb6
Instruction Fuzzy Hash: 6CE092715016247BD7241B729C4DFEB7E6EEF42BB1F901019F109D1080DAA4C881D6B0

Function 00678863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 005F9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 005F9693
Part of subcall function 005F9639: SelectObject.GDI32(?,00000000), ref: 005F96A2
Part of subcall function 005F9639: BeginPath.GDI32(?), ref: 005F96B9
Part of subcall function 005F9639: SelectObject.GDI32(?,00000000), ref: 005F96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00678887
LineTo.GDI32(?,?,?), ref: 00678894
EndPath.GDI32(?), ref: 006788A4
StrokePath.GDI32(?), ref: 006788B2

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: ce92acc621c8703f220ffa639ae10fcc16ac31b43d6c108105d1667d6b3d3b7a
Instruction ID: 5e27b77e99d8352de38b31670a28aeae78b138e107cb45c2e8dfc9b0f60a5901
Opcode Fuzzy Hash: ce92acc621c8703f220ffa639ae10fcc16ac31b43d6c108105d1667d6b3d3b7a
Instruction Fuzzy Hash: 8FF03A36041259FADB126F94AC0DFCA3F5BAF06320F448104FA15651E1C7755591CBE5

Function 005F98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 005F98CC
SetTextColor.GDI32(?,?), ref: 005F98D6
SetBkMode.GDI32(?,00000001), ref: 005F98E9
GetStockObject.GDI32(00000005), ref: 005F98F1

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: cd984835f3dbd3bd48f8736b0bab5c4b5fbb01e52179e36237f2f5ff0255ee8f
Instruction ID: 6e9b70728cbce01838cad707598660d3d875be0dbdebfa2a13db6e2ff499ccd9
Opcode Fuzzy Hash: cd984835f3dbd3bd48f8736b0bab5c4b5fbb01e52179e36237f2f5ff0255ee8f
Instruction Fuzzy Hash: 70E06531244644ABDB215B78AC09BE83F52EB12335F14822DF6F9540E1C77156909B10

Function 0064162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00641634
OpenThreadToken.ADVAPI32(00000000,?,?,?,006411D9), ref: 0064163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,006411D9), ref: 00641648
OpenProcessToken.ADVAPI32(00000000,?,?,?,006411D9), ref: 0064164F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: a2f47e2c7e6153d9935fb21f98a900f2ad2ec3cefb239abd1acb0c73384b5e8e
Instruction ID: 646d90af61c434e89474feca7c7c495343660da654b9f16224cdcd1526033251
Opcode Fuzzy Hash: a2f47e2c7e6153d9935fb21f98a900f2ad2ec3cefb239abd1acb0c73384b5e8e
Instruction Fuzzy Hash: FCE08C32602211EBD7201FB0AE0DF863B7EAF457B2F15880CF249DD090E63484C0CBA4

Function 0063D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0063D858
GetDC.USER32(00000000), ref: 0063D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0063D882
ReleaseDC.USER32(?), ref: 0063D8A3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1a8473ca3657abdfc000e5b0e218639203e1cafb6dcac6385b6af8f8e3a07255
Instruction ID: 82fa44212a2f62002e61accf0584bc90d3dbc3b2ac6ad125a34de1f6f88a853e
Opcode Fuzzy Hash: 1a8473ca3657abdfc000e5b0e218639203e1cafb6dcac6385b6af8f8e3a07255
Instruction Fuzzy Hash: D2E01AB0800205EFCB45AFB0D84C66DBFB7FB08320F209409E85AE7250DB389982AF50

Function 0063D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0063D86C
GetDC.USER32(00000000), ref: 0063D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0063D882
ReleaseDC.USER32(?), ref: 0063D8A3

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3ed3eaf65832504ed9b9ca70983433b23eddf24b32dbd2947455043fb7b64935
Instruction ID: 10066a98af996a3704b8288cba628a5d2a4f54dde91bed38ad7003864ad7cb36
Opcode Fuzzy Hash: 3ed3eaf65832504ed9b9ca70983433b23eddf24b32dbd2947455043fb7b64935
Instruction Fuzzy Hash: 30E01A70C00204DFCB45AFB0D84C66DBFB6BB08320B109408E95AE7250DB3859819F50

Function 00654D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 005E7620: _wcslen.LIBCMT ref: 005E7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00654ED4

Strings

LPT, xrefs: 00654DFB
*, xrefs: 00654E10

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 1354c4ad796cafb8f5eac41d28d3d5fd67c87226d68f7f68944adfbf625dfc97
Instruction ID: f34b961228da997e26cd3d70436179e2c03c543804863219fc820fa39e062ff7
Opcode Fuzzy Hash: 1354c4ad796cafb8f5eac41d28d3d5fd67c87226d68f7f68944adfbf625dfc97
Instruction Fuzzy Hash: 739173759002459FCB14DF58C484EA9BBF2BF88308F1580D9E84A5F362DB35ED89CB50

Function 0060E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0060E30D

Strings

pow, xrefs: 0060E2E5, 0060E302

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 53ba0f5105f15af0f953e4569f24a3502c097ae53088ddd0297fd76fa148b692
Instruction ID: 76f77b46e91e901a9b2f29211ea3f93ed276a784fa8569f62b15ab4e2658171a
Opcode Fuzzy Hash: 53ba0f5105f15af0f953e4569f24a3502c097ae53088ddd0297fd76fa148b692
Instruction Fuzzy Hash: D9510771A8C106A6CB196714D9513EB3BF7AF40740F384D98E095423E9DA368CD29A8A

Function 00667771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0063569E,00000000,?,0067CC08,?,00000000,00000000), ref: 006678DD

Part of subcall function 005E6B57: _wcslen.LIBCMT ref: 005E6B6A

CharUpperBuffW.USER32(0063569E,00000000,?,0067CC08,00000000,?,00000000,00000000), ref: 0066783B

Strings

<sj, xrefs: 006677C8

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <sj
API String ID: 3544283678-2068146069
Opcode ID: f8e74ea6c1e5fc4a1d6a397ec21a9996e0a8c6f554416e691a5aefc370d8691f
Instruction ID: a5cc7efd6a6735d47313bdb7ed375a05859cc1c8713a6ffa264baee9cc85246e
Opcode Fuzzy Hash: f8e74ea6c1e5fc4a1d6a397ec21a9996e0a8c6f554416e691a5aefc370d8691f
Instruction Fuzzy Hash: E161813291415AAACF08EBA1CC95DFDBBB6BF58304F544529F582B3191EF306E45CBA0

Function 005FE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 005FE1B1

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 0cee19cda1bdef2b8f3d5d91492fff26a5db01cceeb4d74b56b7f3e5c00646d4
Instruction ID: cdae4c833df9a9a7a33aef2152984eabc8209e49284ae82ba1c944223545f352
Opcode Fuzzy Hash: 0cee19cda1bdef2b8f3d5d91492fff26a5db01cceeb4d74b56b7f3e5c00646d4
Instruction Fuzzy Hash: 5951343990024ADFDB18DF28C4866FA7FBAFF55310F644055E9919B2E0E7359D42CBA0

Function 005FF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 005FF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 005FF2BB

Strings

@, xrefs: 005FF2AF

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 79ec74633974209ddd6306f98a0edee82ddd779f15e9429ac5cdb74dc2697425
Instruction ID: a2555f878326fc32a29baf9e829d467e266b294c70717ba8a3e3b1ec01ed151a
Opcode Fuzzy Hash: 79ec74633974209ddd6306f98a0edee82ddd779f15e9429ac5cdb74dc2697425
Instruction Fuzzy Hash: 75514B714087899BD320AF11DC8ABABBBF9FFC5300F81485DF1E941195EB319529CB66

Function 00665745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 006657E0
_wcslen.LIBCMT ref: 006657EC

Strings

CALLARGARRAY, xrefs: 006657E6, 006657EB

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: a330969737d1a435622925fbcf5244266a32e970a85cb4799a5313dcc8c96ea9
Instruction ID: 5469f388a368fb9cac80e0a438c52fb4857760f1cd044ed5d89bf32df3964a1d
Opcode Fuzzy Hash: a330969737d1a435622925fbcf5244266a32e970a85cb4799a5313dcc8c96ea9
Instruction Fuzzy Hash: 51418171A0021A9FCB14DFA9C8869FEBBB6FF59320F14406DE506A7351E7349D81CB90

Function 0065D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0065D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0065D13A

Strings

|, xrefs: 0065D10B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: af86a9ffd3962c1bab60a20903c0ec5a61d6da757d281f563d0278ab14f65dc2
Instruction ID: 2824db03310b95f1d9f89957c81b4a459792e2d758373c8fbb16c4b49a1ef84f
Opcode Fuzzy Hash: af86a9ffd3962c1bab60a20903c0ec5a61d6da757d281f563d0278ab14f65dc2
Instruction Fuzzy Hash: 30313271D0010AABCF25EFA5CC45AEF7FBAFF54340F000059F915A61A1D731A946CB60

Function 0067356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00673621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0067365C

Strings

static, xrefs: 006735BC

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 7567b63ba3b34b9b7ca5d5715420c7f892f5da608a544d8a28d4bd5879cfa72e
Instruction ID: f12f191bbfbf04e6f90a9aeb1486913cc3e49212e49d1372d60a512304622891
Opcode Fuzzy Hash: 7567b63ba3b34b9b7ca5d5715420c7f892f5da608a544d8a28d4bd5879cfa72e
Instruction Fuzzy Hash: F8318C71110204AEEB14DF78DC84AFB77AAFF88760F10D61DF9A997280DA31AD819760

Function 00674537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0067461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00674634

Strings

', xrefs: 0067458E

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 4ce8f2e0df6158943d7fd2bfee07d17c6b045c2b1c67ccfe440937173bd9e52a
Instruction ID: 9bb9ef9dbc1c6f5396853fbf0d8985370c83caf3840f41fd5478325ccb8b4f3e
Opcode Fuzzy Hash: 4ce8f2e0df6158943d7fd2bfee07d17c6b045c2b1c67ccfe440937173bd9e52a
Instruction Fuzzy Hash: 233139B4A01209AFEB14CF69C994BDA7BB6FF49300F108069E908AB351DB70E941CF90

Function 006731EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0067327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00673287

Strings

Combobox, xrefs: 00673249

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 50fea000182fb285fec6c11b754d2e23d3a39b631e29033033e149f0c2dbe644
Instruction ID: 3f499dc4a7d8c0060ef73decc3eca274cead6d9e676077c6771e54896c19a103
Opcode Fuzzy Hash: 50fea000182fb285fec6c11b754d2e23d3a39b631e29033033e149f0c2dbe644
Instruction Fuzzy Hash: CA1190713002197FEF259F54DC84EEB3B6BEB993A4F108128F928A7391D6319E519760

Function 00673710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 005E600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 005E604C
Part of subcall function 005E600E: GetStockObject.GDI32(00000011), ref: 005E6060
Part of subcall function 005E600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 005E606A

GetWindowRect.USER32(00000000,?), ref: 0067377A
GetSysColor.USER32(00000012), ref: 00673794

Strings

static, xrefs: 00673757

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 8c81f56cfda0b0305bf73c64a0df7c60010a22a14ba452cc263e19bae8b2ab37
Instruction ID: ccbe2f929196d0bc2491a8e755af6da0747889634463c4b0514c84d0ea6cb0a3
Opcode Fuzzy Hash: 8c81f56cfda0b0305bf73c64a0df7c60010a22a14ba452cc263e19bae8b2ab37
Instruction Fuzzy Hash: E7116AB261021AAFDF04DFB8CC45EEA7BB9FB08354F004918F959E3250E735E8519B50

Function 0065CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0065CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0065CDA6

Strings

<local>, xrefs: 0065CD66

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: c093438136fb88aa552ba3fb6a006a1f2afa3f26d01b268665db10542e140727
Instruction ID: 64f257e61abd1e5009e733d50c2d288e1dc70770ce417909f5b2784ab873fa21
Opcode Fuzzy Hash: c093438136fb88aa552ba3fb6a006a1f2afa3f26d01b268665db10542e140727
Instruction Fuzzy Hash: 3211A071205735BED7284B668C49FE7BEBAEF527B5F00432AB909C2180D6609849D6F0

Function 00673429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 006734AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 006734BA

Strings

edit, xrefs: 0067348F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: dac84a816c1f47f0e002bbc1dfe6845c6f5f04e2c162954fea29b6e9a96a4278
Instruction ID: ab3002d710d23f310ddb5e858f9b2349c789ad5b7ff2750aed3823d1dcad9fe4
Opcode Fuzzy Hash: dac84a816c1f47f0e002bbc1dfe6845c6f5f04e2c162954fea29b6e9a96a4278
Instruction Fuzzy Hash: 3E11BF71100118AFEB158F64DC44AEB37ABEB15374F608328FA68933D8C731DC91A750

Function 00646C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00646CB6
_wcslen.LIBCMT ref: 00646CC2

Strings

STOP, xrefs: 00646CBC, 00646CC1

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: b74930cfae1e4063d93d1d1b5f885333fced8a49602aeea3d6a6717c899df837
Instruction ID: 658bc8b5c856796ea7ce2785d45449f472ff8cdb234a53f7e001db2dfff687bc
Opcode Fuzzy Hash: b74930cfae1e4063d93d1d1b5f885333fced8a49602aeea3d6a6717c899df837
Instruction Fuzzy Hash: 1801C432A005278ACB24AFBDDC859FF77A7FFA37147500538F85296290EA31DD41C651

Function 00641CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 00643CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00643CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00641D4C

Strings

ListBox, xrefs: 00641D16
ComboBox, xrefs: 00641CEB

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 961a3a86a388b5521a1a1d4002963165a3a3a0c29e523a0a7730bb08c18b5ce4
Instruction ID: 1a25d7d68e296bff733a304a6c6b2040173c9d5e6c96d1016918fec9e3ee148f
Opcode Fuzzy Hash: 961a3a86a388b5521a1a1d4002963165a3a3a0c29e523a0a7730bb08c18b5ce4
Instruction Fuzzy Hash: F0012871A00219ABCB18FFA0CC55DFE776AFF43350B100919F8625B3D1EA305D498660

Function 00641BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 00643CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00643CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00641C46

Strings

ListBox, xrefs: 00641C10
ComboBox, xrefs: 00641BE5

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ca83882f58e95b37b9bce39761f37fb5125d404d44d618644fa010123834f749
Instruction ID: 14976f4debc867a6598a0044558b903c58ba76e2b991199838a2be7c7cdf8cea
Opcode Fuzzy Hash: ca83882f58e95b37b9bce39761f37fb5125d404d44d618644fa010123834f749
Instruction Fuzzy Hash: 4A01A77568111966CB18FB90CE95AFF77AAAB52340F140019A84667281EA249E4986B1

Function 00641C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 00643CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00643CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00641CC8

Strings

ListBox, xrefs: 00641C94
ComboBox, xrefs: 00641C69

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: e1e606dcffa356797cf1a5d482af953004e43a2ef7b9bfcf0c2f4b3f644d0b23
Instruction ID: 210f1115acf94f95a2562cae4d55140cc8c5a0bcdc9afe59ea280f3c8193ae8c
Opcode Fuzzy Hash: e1e606dcffa356797cf1a5d482af953004e43a2ef7b9bfcf0c2f4b3f644d0b23
Instruction Fuzzy Hash: 9301D6716C011967CB18FBA1CE95AFE77AAAB12340F540019B84677381FA249F49C671

Function 005FA4D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005FA529

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Strings

3yc, xrefs: 005FA545, 005FA54D, 005FA552
,%k, xrefs: 005FA509

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Init_thread_footer_wcslen
String ID: ,%k$3yc
API String ID: 2551934079-264884146
Opcode ID: 60cea029f3cbf5c91b4fdc17dd83c97c6eac0d3dfe35c5f362388d510ea1ceda
Instruction ID: 7df71ddc931ab36b51e7e8d7fc0753978c9a3f8647f73ad221c5a9dfd74c6d6e
Opcode Fuzzy Hash: 60cea029f3cbf5c91b4fdc17dd83c97c6eac0d3dfe35c5f362388d510ea1ceda
Instruction Fuzzy Hash: F0017BB274061A97CE18F768DC1FBBD3F56FB45710F500568F60A171C2EE149D418697

Function 00641D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005E9CB3: _wcslen.LIBCMT ref: 005E9CBD

Part of subcall function 00643CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00643CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00641DD3

Strings

ListBox, xrefs: 00641DA0
ComboBox, xrefs: 00641D75

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: ac7e7653d07508d9e4c2ea851dedef5d35b2a2ea78f13eaa997d99be6297fb5a
Instruction ID: bb6ee6df2e777d0c7f09eb69e5d34d0ddf9185c5ccb479524482d8df7984a1be
Opcode Fuzzy Hash: ac7e7653d07508d9e4c2ea851dedef5d35b2a2ea78f13eaa997d99be6297fb5a
Instruction Fuzzy Hash: 2AF0F4B1F4021566CB18F7A4CC96BFE776ABF42350F040919B862672C1EA605D488660

Function 00678172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,006B3018,006B305C), ref: 006781BF
CloseHandle.KERNEL32 ref: 006781D1

Strings

\0k, xrefs: 0067818A

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0k
API String ID: 3712363035-2680258789
Opcode ID: ec3fda3be859a20789bb83c6346f1afa21b223b8956073275f0adeec1047a615
Instruction ID: a84dff1ea563ad31bb4a298b5c7dcfd982d1ab62530024b4623ac4ffe44e6a00
Opcode Fuzzy Hash: ec3fda3be859a20789bb83c6346f1afa21b223b8956073275f0adeec1047a615
Instruction Fuzzy Hash: 1FF054F1780720BEE3147B656C59FB73A5EDF04764F005424BB0CD52A1D6769E8083B8

Function 0066747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00667493
_wcslen.LIBCMT ref: 006674B9

Strings

3, 3, 16, 1, xrefs: 00667483

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 5655a31ee84421c2c05be1592d7146db1cc55c1a26d488e70e4fb2198f2b573b
Instruction ID: d959d16abf7d78dd05a20f5ffbf6b370dcef612ca9e5a8cd7e7689f5c6cf4782
Opcode Fuzzy Hash: 5655a31ee84421c2c05be1592d7146db1cc55c1a26d488e70e4fb2198f2b573b
Instruction Fuzzy Hash: FDE02B4224522010D2752279DCC5ABF57CBCFC5B50B10183FFE81C23A6EE948D9193E4

Function 00640B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00640B23

Strings

AutoIt, xrefs: 00640B17
Error allocating memory., xrefs: 00640B1C

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 8d4dbf61c90b12a60db9c71aa1310b28cb425bc3c7f14bc096b46046d06e5dde
Instruction ID: 550d800c4c5a659930c1ce0fc8ac4825bd3ab93c7f83306fff9afb9beefcc4e8
Opcode Fuzzy Hash: 8d4dbf61c90b12a60db9c71aa1310b28cb425bc3c7f14bc096b46046d06e5dde
Instruction Fuzzy Hash: 56E0D83228431926D2583654BC07F897E86DF05B64F10442EF78C995C3CEE2649046AD

Function 00600D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005FF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00600D71,?,?,?,005E100A), ref: 005FF7CE

IsDebuggerPresent.KERNEL32(?,?,?,005E100A), ref: 00600D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,005E100A), ref: 00600D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00600D7F

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: c1d4998837896b89a58ac9c0205d58a82919f4d4b98111bea505af1866ffabca
Instruction ID: fcad1968ffe176374e06ff32c92104b580bca03dd8b5bcc8f9ae39fda659e5f1
Opcode Fuzzy Hash: c1d4998837896b89a58ac9c0205d58a82919f4d4b98111bea505af1866ffabca
Instruction Fuzzy Hash: 2AE06D702007418BE364AFB8E8087437BE2FF00744F00892DE49AC6692EBB5E5848BA1

Function 005FE398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 005FE3D5

Strings

8%k, xrefs: 005FE3CA
0%k, xrefs: 005FE3B5

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%k$8%k
API String ID: 1385522511-3140963459
Opcode ID: 32ad67b042956ca81a4dab7c7f43861c70e00a3e68f30efbb088a2d4b54a8007
Instruction ID: 28de8d82b771b6227ee25b80b08855d2e5f4d3e7980c25780d0badd8ce2c488f
Opcode Fuzzy Hash: 32ad67b042956ca81a4dab7c7f43861c70e00a3e68f30efbb088a2d4b54a8007
Instruction Fuzzy Hash: E7E02073440919CBC7349B18B87EAE837D7FB04320B101A68E203471E19B3438C18659

Function 00653017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0065302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00653044

Strings

aut, xrefs: 00653038

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: bf14f4eec309dbed716097e62f537d6eb3b3d4acf65a2c9c83b61cc2035abb1b
Instruction ID: fe7fe4bf9c6c0cc9098aabf0902a7eaaa01bc78d543bde2ac0897043b4c0b96b
Opcode Fuzzy Hash: bf14f4eec309dbed716097e62f537d6eb3b3d4acf65a2c9c83b61cc2035abb1b
Instruction Fuzzy Hash: 9ED05B7250031467DB20A7949C0DFC73A6CD705760F0001517655D2091DAB09F84CBD0

Function 0063D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0063D220

Strings

X64, xrefs: 0063D2A8
%.3d, xrefs: 0063D22B

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 678bd5b2140ffa66409d47d5c19d761b72a8d435ae42efbdd6701fecb227b353
Instruction ID: f66ca8eb61149472140bc366383ee9600cec64ce8b47d144e208275b144f5edb
Opcode Fuzzy Hash: 678bd5b2140ffa66409d47d5c19d761b72a8d435ae42efbdd6701fecb227b353
Instruction Fuzzy Hash: 24D01261808109E9CB9096D0EC498BBB77EBB18301F608452FE06D1041EA38C7496BA1

Function 00672356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0067236C
PostMessageW.USER32(00000000), ref: 00672373

Part of subcall function 0064E97B: Sleep.KERNELBASE ref: 0064E9F3

Strings

Shell_TrayWnd, xrefs: 00672365

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 3db8c3b5adff25aafa75a72915b65151bc98acc8863cb30cc574ae41406090be
Instruction ID: aa4bf2fdb448f9a552c627e9d419d01c990f4b983b1f38d2f2c2f864770a21ed
Opcode Fuzzy Hash: 3db8c3b5adff25aafa75a72915b65151bc98acc8863cb30cc574ae41406090be
Instruction Fuzzy Hash: 6ED0C932391310BAE7A8B770DC4FFC6A616AB05B20F01591AB649AA1D0C9A1A8418A58

Function 00672322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0067232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0067233F

Part of subcall function 0064E97B: Sleep.KERNELBASE ref: 0064E9F3

Strings

Shell_TrayWnd, xrefs: 00672325

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: b1144a4fb3c83130c30dbe36f52ace2db54c63a3a5a419d842fcaeb4a3ac2be0
Instruction ID: b4e6d1c649075270b75497f5c6b6f4b409af4abaee2f5029440718c9acb8d79b
Opcode Fuzzy Hash: b1144a4fb3c83130c30dbe36f52ace2db54c63a3a5a419d842fcaeb4a3ac2be0
Instruction Fuzzy Hash: 52D01236394310B7E7A8B770DC4FFC6BA16AB00B20F01591EB749AA1D0C9F1A841CE54

Function 0061BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0061BE93
GetLastError.KERNEL32 ref: 0061BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0061BEFC

Memory Dump Source

Source File: 00000000.00000002.2916184516.00000000005E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005E0000, based on PE: true

Associated: 00000000.00000002.2916158247.00000000005E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.000000000067C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916291390.00000000006A2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916380727.00000000006AC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2916405398.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: e1eef147a70186d5f1eda04b1aa7ff8b2654b53bd095404d3b1e938ba3647ebf
Instruction ID: 7bd17c590e08b2e8f654d97dc48e3bfd0288ea3439cbfe15809cc0e4dbd38485
Opcode Fuzzy Hash: e1eef147a70186d5f1eda04b1aa7ff8b2654b53bd095404d3b1e938ba3647ebf
Instruction Fuzzy Hash: F541E734600206AFCF258FA5CC44AFA7BA7EF41360F18916DF959972E1DB308D82CB50

Source: Joe Sandbox View	IP Address: 23.200.0.42 23.200.0.42
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60

Source: file.exe	Virustotal: Detection: 24%			Perma Link
Source: file.exe	ReversingLabs: Detection: 21%

Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: POST /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveContent-Length: 470Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726023792&P2=404&P3=2&P4=QEgMGZbL3Pd%2bfrib5J8QmPE3IgrGPOf1mROENn0UQDviE01AkgpDuSO7Xs%2f%2bTYts5mnwRHQfEVIzX0nnjovayw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: PLv1kfp2Cqs/R4Pe8oDocQSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.3
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.174
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.72.100

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1e6ddabb-fbb8-4c12-b2cd-2105ab65bf91.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\58281efe-723d-4e39-a55b-aa8c272d844b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5bffa406-28db-40c6-98e7-85f88360d5bd.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\609f04f1-22f6-48f5-9649-bbcd8f2428ba.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6a5c29ab-4ddd-4b15-aab8-1d2d74634b05.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\81433baa-9b7b-4c48-80de-f1fde4ea0173.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\9b44953f-41cd-4f96-9bf6-3e61ec8f4708.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\ee3242ec-ac45-4c12-b547-0ce4e8fc8055.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D7CDDE-1CA8.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D7CDDE-1DA4.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0ceb2194-f25d-4cfb-95b3-75131457d82b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1de9c5b7-bc10-4728-814e-c4ea913a4fe9.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\288a47aa-de89-410d-b457-f02f7892bd8c.tmp

Windows Analysis Report
file.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre