Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1503887
MD5:	29602bd4c22f67125f6088e167b15765
SHA1:	5dc54cf559a0f6264ac26984307132fa0a67b6e7
SHA256:	4c519238b34233a799762539be743fec5361da87fbce57a33f02e5828bda9a7a
Tags:	exe
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Maps a DLL or memory area into another process

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7736 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 29602BD4C22F67125F6088E167B15765)

msedge.exe (PID: 7752 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8004 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2104,i,14732050079847253927,277997642366932063,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8012 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1184 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2928 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9068 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6376 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9076 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6316 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6744 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6744 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 3060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7460 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3488 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9680 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9696 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 10200 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9860 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2052,i,2939389132138757947,6644282390956280002,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1460 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 10008 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1460,i,14181872830460904141,6941328671088109176,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8520 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9980 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=2020,i,12012237615067922076,315425196457050801,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Length: 326Content-Type: text/html; charset=us-asciiDate: Wed, 04 Sep 2024 04:24:00 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.84112317.1725423840.8e9342aAccess-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: *Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin: *

Source: file.exe, 00000000.00000002.2908749797.0000000001920000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2908749797.00000000018F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.5.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.5.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.5.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.11.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.11.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.11.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 8bff7942-f985-4d48-b66c-81a7ca75c809.tmp.12.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.11.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 8bff7942-f985-4d48-b66c-81a7ca75c809.tmp.12.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.11.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.11.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.5.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.5.dr	String found in binary or memory: https://msn.com
Source: content_new.js.11.dr, content.js.11.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 8bff7942-f985-4d48-b66c-81a7ca75c809.tmp.12.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.4.dr, Top Sites.11.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 62567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 62568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62568
Source: unknown	Network traffic detected: HTTP traffic on port 62579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62565
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 62565 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 62571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62571
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62577
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62578
Source: unknown	Network traffic detected: HTTP traffic on port 62566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62577 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:62571 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0099EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0099EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0099ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0099ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_0099EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0098AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0098AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009B9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_009B9576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1654652408.00000000009E2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_8edd1c1a-0
Source: file.exe, 00000000.00000000.1654652408.00000000009E2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_fe4ea24f-e
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d63e8be6-f
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_e7503897-5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0098D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0098D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00981201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00981201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0098E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0098E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00992046	0_2_00992046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00928060	0_2_00928060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00988298	0_2_00988298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095E4FF	0_2_0095E4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095676B	0_2_0095676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B4873	0_2_009B4873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094CAA0	0_2_0094CAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092CAF0	0_2_0092CAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093CC39	0_2_0093CC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00956DD9	0_2_00956DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009291C0	0_2_009291C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093B119	0_2_0093B119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00941394	0_2_00941394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00941706	0_2_00941706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094781B	0_2_0094781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009419B0	0_2_009419B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00927920	0_2_00927920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093997D	0_2_0093997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00947A4A	0_2_00947A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00947CA7	0_2_00947CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00941C77	0_2_00941C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00959EEE	0_2_00959EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009ABE44	0_2_009ABE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00941F32	0_2_00941F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0093F9F2 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00940A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@96/527@22/12

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009937B5 GetLastError,FormatMessageW,

0_2_009937B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009810BF AdjustTokenPrivileges,CloseHandle,		0_2_009810BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009816C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_009816C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009951CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_009951CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009AA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_009AA67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0099648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0099648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009242A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_009242A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\24cc1bcb-72da-4bf8-90cf-57305cae8ac6.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.4.dr, Login Data.11.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 21%
Source: file.exe	Virustotal: Detection: 24%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2104,i,14732050079847253927,277997642366932063,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2928 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6376 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6316 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6744 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6744 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3488 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2052,i,2939389132138757947,6644282390956280002,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1460,i,14181872830460904141,6941328671088109176,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=2020,i,12012237615067922076,315425196457050801,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2104,i,14732050079847253927,277997642366932063,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2928 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6376 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6316 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6744 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6744 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3488 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2052,i,2939389132138757947,6644282390956280002,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1460,i,14181872830460904141,6941328671088109176,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=2020,i,12012237615067922076,315425196457050801,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009242DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00940A76 push ecx; ret

0_2_00940A89

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0093F98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_009B1C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-96554

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6617

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.3 %

Source: C:\Users\user\Desktop\file.exe TID: 7740

Thread sleep time: -66170s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6617 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0098DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009968EE FindFirstFileW,FindClose,	0_2_009968EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0099698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0098D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0098D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00999642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00999642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0099979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00999B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00999B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00995C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00995C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009242DE

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-96764

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0099EAA2 BlockInput,

0_2_0099EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00952622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00952622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009242DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00944CE8 mov eax, dword ptr fs:[00000030h]

0_2_00944CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00980B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00980B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00952622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00952622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0094083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009409D5 SetUnhandledExceptionFilter,	0_2_009409D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00940C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00940C21

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00981201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00962BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00962BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0093F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_0093F98E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009A22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_009A22DA

Source: C:\Users\user\Desktop\file.exe

0_2_00980B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00981663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00981663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00940698 cpuid

0_2_00940698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00998195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00998195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0097D27A GetUserNameW,

0_2_0097D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0095BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0095BB6F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009242DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009242DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_009A1204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_009A1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 Masquerading	LSA Secrets	22 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
file.exe	21%	ReversingLabs
file.exe	24%	Virustotal	Browse
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Virustotal		Browse
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Virustotal		Browse
https://msn.com	0%	Virustotal		Browse
https://chrome.google.com/webstore/	0%	Virustotal		Browse
https://www.office.com/	0%	Virustotal		Browse
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Virustotal		Browse
https://docs.google.com/	0%	Virustotal		Browse
https://www.google.com/favicon.ico	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	172.217.16.193	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.4.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.11.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://msn.com	data_10.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.4.dr, Top Sites.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.4.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.5.dr	false	URL Reputation: safe	unknown
https://drive-staging.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content_new.js.11.dr, content.js.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://drive.google.com/	manifest.json0.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.4.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.11.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com	8bff7942-f985-4d48-b66c-81a7ca75c809.tmp.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/	manifest.json.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.11.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.219.161.132	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.251.35.174	unknown	United States	15169	GOOGLEUS	false
142.251.179.84	unknown	United States	15169	GOOGLEUS	false
142.251.40.238	unknown	United States	15169	GOOGLEUS	false
142.250.81.228	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.16.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1503887
Start date and time:	2024-09-04 06:21:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@96/527@22/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 41 Number of non-executed functions: 309
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 13.107.21.239, 204.79.197.239, 64.233.166.84, 13.107.6.158, 2.19.126.145, 2.19.126.152, 216.58.206.67, 216.58.212.163, 2.23.209.187, 2.23.209.130, 2.23.209.161, 2.23.209.189, 2.23.209.193, 2.23.209.177, 2.23.209.176, 2.23.209.185, 2.23.209.148, 20.103.156.88, 142.250.186.46, 199.232.214.172, 192.229.221.95, 142.250.185.202, 142.250.181.234, 142.250.185.106, 142.250.186.138, 142.250.185.138, 142.250.185.234, 142.250.185.170, 216.58.206.42, 216.58.212.138, 142.250.184.202, 142.250.184.234, 172.217.16.138, 142.250.186.106, 142.250.186.74, 142.250.185.74, 142.250.186.170, 142.251.35.163, 142.250.65.163, 172.217.165.131, 142.250.65.227, 142.250.80.35, 142.250.81.227, 142.251.40.195, 142.251.41.3
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, dns.msftncsi.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, iris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.az
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:22:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
05:22:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
05:22:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
05:22:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5
23.219.161.132	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	tXwWf89bXc.exe	Get hash	malicious	Unknown	Browse
	UPrvrJFnEx.exe	Get hash	malicious	Unknown	Browse
	oDkJQOSVzf.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	https://www.google.com/url?q=https://google.com/url?hl%3Den%26q%3Dhttps://google.com/url?q%3DJFt7SBpfnkz37NXTPycl%26rct%3DecYm4gDyqlWjNVTtaSh7%26sa%3Dt%26esrc%3DyN3TRjFzCWurgbW1vOG4%26source%3DzcMGnUNgngXYWBYW2c3r%26cd%3DqBH0Ch4Gn8VGtKfHcUPR%26cad%3D0q4c3js52qUrSH6rI5Ux%26ved%3DxpZpiH8kwVo72kkPvwUH%26uact%3DhzYhur4iRKYoiuCfwC6s%26url%3Damp%252Fareaazul.com.mx%252F.beans%252F&source=gmail&ust=1725454484963000&usg=AOvVaw2xy0LT_ByjSLCoEqCzpyxV#e3YsAE-SURELILYZmFiM3NtcF9wY0BnbG9iYWxmb3VuZHJpZXMuY29t	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Other.Malware-gen.18317.3179.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	malicious.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	INVCherokeebrick.html	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	CODX.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	CODX.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://metaverifiedbadges.co/175261668994311/index.php?nick=YWZyaWNhbmJ1c2hjYW1wcw==&id=1526032324	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://swishmax.en.download.it/	Get hash	malicious	PureLog Stealer	Browse	172.64.41.3
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	https://swishmax.en.download.it/	Get hash	malicious	PureLog Stealer	Browse	152.199.21.175
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	xde1wui2zjw.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, XWorm	Browse	188.114.96.3
	TK7.vbs	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	CODX.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	CODX.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	http://www.conchtech.com/	Get hash	malicious	Unknown	Browse	188.114.96.3
	ATT.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://www.google.com/url?q=https://google.com/url?hl%3Den%26q%3Dhttps://google.com/url?q%3DJFt7SBpfnkz37NXTPycl%26rct%3DecYm4gDyqlWjNVTtaSh7%26sa%3Dt%26esrc%3DyN3TRjFzCWurgbW1vOG4%26source%3DzcMGnUNgngXYWBYW2c3r%26cd%3DqBH0Ch4Gn8VGtKfHcUPR%26cad%3D0q4c3js52qUrSH6rI5Ux%26ved%3DxpZpiH8kwVo72kkPvwUH%26uact%3DhzYhur4iRKYoiuCfwC6s%26url%3Damp%252Fareaazul.com.mx%252F.beans%252F&source=gmail&ust=1725454484963000&usg=AOvVaw2xy0LT_ByjSLCoEqCzpyxV#e3YsAE-SURELILYZmFiM3NtcF9wY0BnbG9iYWxmb3VuZHJpZXMuY29t	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://850705.formstack.com/forms/23outlook	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.42
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	http://xsdrt.hanslot88gacor.com/4fBcna16686hpgN1202wmiembuhsb14569WJUNFCAXDHLQZZY1707NPBU18900N17	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	Unknown	Browse	13.107.246.51
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.57
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.57
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	Unknown	Browse	173.222.108.211
	file.exe	Get hash	malicious	Unknown	Browse	23.55.235.170
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	23.59.250.83
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.38
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=lTCgUqihHkmFBEet2SbJL2ghryGY169Ih8KbdC_V2rZUQUFOTzhQMTZVVVI2V1RWNjNGNFhXRjdWVy4u&d=DwMFAg	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.83.5.113
EDGECASTUS	https://www.google.com/url?q=https://google.com/url?hl%3Den%26q%3Dhttps://google.com/url?q%3DJFt7SBpfnkz37NXTPycl%26rct%3DecYm4gDyqlWjNVTtaSh7%26sa%3Dt%26esrc%3DyN3TRjFzCWurgbW1vOG4%26source%3DzcMGnUNgngXYWBYW2c3r%26cd%3DqBH0Ch4Gn8VGtKfHcUPR%26cad%3D0q4c3js52qUrSH6rI5Ux%26ved%3DxpZpiH8kwVo72kkPvwUH%26uact%3DhzYhur4iRKYoiuCfwC6s%26url%3Damp%252Fareaazul.com.mx%252F.beans%252F&source=gmail&ust=1725454484963000&usg=AOvVaw2xy0LT_ByjSLCoEqCzpyxV#e3YsAE-SURELILYZmFiM3NtcF9wY0BnbG9iYWxmb3VuZHJpZXMuY29t	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	https://smruti-ranjan-sahoo-tech.github.io/NetflixClone	Get hash	malicious	HTMLPhisher	Browse	152.199.21.141
	https://www.dropbox.com/l/scl/AACzaw-9E1aatxpEZpO1dkWZ_aWUL6KS_-Q	Get hash	malicious	Unknown	Browse	152.195.15.58
	https://swishmax.en.download.it/	Get hash	malicious	LummaC Stealer, PureLog Stealer	Browse	152.195.19.97
	https://atpscan.global.hornetsecurity.com/index.php?atp_str=JXO3llrC97LYt_ypBDUoorYJESJf_lVgqG94Q8CbqZFSucjhJ8shDRR62UMpOfWQEisKw1UhsaXC2ei6wkJxZ78OKelMPUchf388beflwplmZ9bsAPTRZu8n2NfDqe2KOq7qiRxW9yxw4ZvRTonwJ07YfeXP0wQbvM2OFZWKje16pzGewsFyDVh5wRpEWnv0S9MgBr6GHEuMWbm1mAAXlTqLCgPJeXvAjfP8eHiPv4oozYP6pyTpRvkqdbjPLuTxQioCKIkn36kINOGd5zWy55BalBA1C-XppBzBxrZorCxNjXPTfp7EqG_ugHFutapq8UvczmG4Izo6I53rM9MZbHlXhpjq_iM6OiP6x3HRdgKt2jAlBNssK8G1	Get hash	malicious	Unknown	Browse	152.199.21.175
	PO#86637.lzh	Get hash	malicious	FormBook	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	malicious.html	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.google.com/url?q=https://google.com/url?hl%3Den%26q%3Dhttps://google.com/url?q%3DJFt7SBpfnkz37NXTPycl%26rct%3DecYm4gDyqlWjNVTtaSh7%26sa%3Dt%26esrc%3DyN3TRjFzCWurgbW1vOG4%26source%3DzcMGnUNgngXYWBYW2c3r%26cd%3DqBH0Ch4Gn8VGtKfHcUPR%26cad%3D0q4c3js52qUrSH6rI5Ux%26ved%3DxpZpiH8kwVo72kkPvwUH%26uact%3DhzYhur4iRKYoiuCfwC6s%26url%3Damp%252Fareaazul.com.mx%252F.beans%252F&source=gmail&ust=1725454484963000&usg=AOvVaw2xy0LT_ByjSLCoEqCzpyxV#e3YsAE-SURELILYZmFiM3NtcF9wY0BnbG9iYWxmb3VuZHJpZXMuY29t	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	https://drive.google.com/file/d/1AembzoaqYVDX_5il1daROZrPkN2ry_oJ/preview	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	https://sites.google.com/view/wcmb?usp=sharing	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	http://www.greenprintlandscapes.com.au	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	http://www.conchtech.com/	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	ATT.html	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	79077
Entropy (8bit):	6.070600105134877
Encrypted:	false
SSDEEP:	1536:8MGQ5XMBG2hUEuI6m5oDm1ZuDLH0R5MTuavaEvPDtTTkkw70Z7ZV:8MrJM82+I6oWuZqHTTVvVvJTTt68tV
MD5:	F26E5D1A1F19F507D5996AA1F3E62902
SHA1:	5017D316910BED193A57C5E8411933B569CB1F6D
SHA-256:	4BC361924E4F99FBE44F7D081F95123EEF381C357B2C213A72E77F4DD0EA8E2D
SHA-512:	36408D696874CE36B437F7CB3D44DB3FE789BA0FB7348B9BE053DFAF5D9C7002D60712CCC68043247DFB205A44B9661E8B50B8DA1383D00B23739D4CC7D19DFD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369897316688684","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5c888c91-8874-4e70-9dc9-c5449467658f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.581351232138808
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afaGnzK7kHB+2drxsvBxWdnrRf1aJkXvchwlRb1oB0:Xq8NkC1faOK6Bz+vOdlfgJkfcOiq
MD5:	EF798FCF6E16373651939C396A9BB40A
SHA1:	D2580EA9B77DAA5500F25AD768A2C1E6C2785F93
SHA-256:	E3819E9FEAF98EB6F8EC3500AF0F643B10A5A8CCAEDACF060DE2939DA131E95C
SHA-512:	131AF07CF98B4D5E4138F41902D470D34196D3873B810707F10C1B980F7C414D645EF517FE5F64C8D28232F8B302AF46DA4CFC8978798B3B932A3EE3401B8FEE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"policy":{"last_statistics_update":"13369897314210358"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5f8c746e-773f-49a2-b285-9076b61ded78.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.581351232138808
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afaGnzK7kHB+2drxsvBxWdnrRf1aJkXvchwlRb1oB0:Xq8NkC1faOK6Bz+vOdlfgJkfcOiq
MD5:	EF798FCF6E16373651939C396A9BB40A
SHA1:	D2580EA9B77DAA5500F25AD768A2C1E6C2785F93
SHA-256:	E3819E9FEAF98EB6F8EC3500AF0F643B10A5A8CCAEDACF060DE2939DA131E95C
SHA-512:	131AF07CF98B4D5E4138F41902D470D34196D3873B810707F10C1B980F7C414D645EF517FE5F64C8D28232F8B302AF46DA4CFC8978798B3B932A3EE3401B8FEE
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"policy":{"last_statistics_update":"13369897314210358"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\74c31f26-8aa4-4492-8487-0569d8f9d9a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518716667362554
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtJ+QZtsynzu6yiksJdXBuBuwBxWa0KNhfTX2QQRCYfYg:YuBqDPafaGnzp7gBzBxWdMfTnB0
MD5:	8AF261AEBF3C2B903739D699E77B4ED7
SHA1:	7A61418F34CF27946D5313245839551D41C63240
SHA-256:	5C2BE8CB0BD4610DCEFE88FC3EAD70CF880E6CB740B4A71B33EE595CFABFD0D6
SHA-512:	FEB22BC1FDA35E68408CF5E9ACE200F88E759726FBC81DDD477CF10CB9E97107CA53445BD6A573EFE942634901CCB7D666CFBE5FFC2317693D8A50580109EF3C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369897314174944","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725423714"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8651fd1c-da57-4edc-a3ef-905988f8ef77.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.602213597089913
Encrypted:	false
SSDEEP:	96:0q8NkC1faOKsABz+vOdi+VJkfcoSDS4S4SDSMlI4a:/8NbsZzi+bkf0
MD5:	C90F4B6A62D749820C1E1EE9AF62D3FA
SHA1:	466BF9A234C9DCCC0D3CA913A84F46F558D4BAD3
SHA-256:	89E13E689BE680900B69DD0868DD3C4C833DBD3AEFDE4086CCEBDDC5BD51EED7
SHA-512:	C6CD1E25BDEFC3E7526284BED3671E3824444F5F6F8366F87F82E687B4AFCBFD0B52D3270C09A63B3BA40F739502F3EE5F3B6D4E5F2F7FB1165414054440255D
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8c965218-6e40-4ea5-88bc-91b3e1efb24f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20990
Entropy (8bit):	6.06291751126813
Encrypted:	false
SSDEEP:	384:ctMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSAVKk+YYfHf7Rp8mE2+I:8MGQ7FCYXGIgtDAWtJ4nMV7jYf/7p/V
MD5:	AAE2274AB9C809301C602E569AB9E5E0
SHA1:	D33862F2691317457BB072BA17CFFC8E2773F3F3
SHA-256:	15222A3DE3F2031AFC89E9C74848DBEB6730AC938A4590073C51A520E0301D44
SHA-512:	C1C26D9090713967605BD7236A4D395697B7D166AB85BA08EC17C68A8057EB0EFDF0B5E12FF65342EC9033262F37298FDD80107E557750DB88D65F84AC89223F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369897316688684","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\ee787fe1-f438-4cb3-93b7-e46c84fce134.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D7E062-1E48.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04050674423442917
Encrypted:	false
SSDEEP:	192:K8dMpYDR/OUU0Nb3HJQSLKegXnrZgkg9oNhPpNEmfSGRQMzRTn8y08Tcm2RGOdB:1dME/FpbHahxZ/fRT08T2RGOD
MD5:	3AC5835B85BC21BB049EA8AE96F76B65
SHA1:	6DF40088DDF5E3F3881CF30E6EBA1379252D6858
SHA-256:	8C0C529F2920FAB3B81D757EFA5932A900EBC96D55D0A2673564CEEC3B9375E2
SHA-512:	0EEF1DDA424F0BFE7A8FA57733D995008D2F59CE875D91D410A1E4C4A90832E94AD7EDDF6DBEA0228A59EE417DB1CDF09C110EBA30A150993C48E519D26A9F9A
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".mklphy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@................................!..$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...b.X9. S@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D7E062-1F4C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.5055764736513881
Encrypted:	false
SSDEEP:	3072:UjoPj+XW3SCwM2FMQZ3DxhOgkfDbIQTbFL/nh9g1HFhholfs/L51pziqJ/bhdioH:g5XNfenh9aHyyJDAoihaHpgUKk0a
MD5:	B5570CF295908C94A5475DC7575AB551
SHA1:	BA8F7F685A303744250DBE30C29DD88F98A67036
SHA-256:	CA71D1B4E1B852F0C3A2F7A107CEDB300BB2466CEAF1FEFAD49A14D22B961A3A
SHA-512:	1170C5958D80885FDB147C5757BBFE396E40B3B19B272680DD632F6EA1044937036F1DF8423A59A1D5435318D8B66C9606FA88E6443B1692B1329BE27AF82A58
Malicious:	false
Preview:	...@..@...@.....C.].....@................1..h0..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".mklphy20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.166603464640917
Encrypted:	false
SSDEEP:	3:FiWWltlDrs8mliHSRqOFhJXI2EyBl+BVP/Sh/Jzvn4Si7P95l:o1c1iyRqsx+BVsJDni7P97
MD5:	606F1B969A4F8CC38A6EB68D71934E87
SHA1:	9642AB92E14544BF44CFABE8A3321AD713365796
SHA-256:	C6D99445718E57C80F5E206ECF19F68EDB58E1E762340EFA110A96D46B66DA74
SHA-512:	CCB2CE663A7AA057AEE9FEA860350FF35664D793F21E9E41A3D274BC30C8861CBAB0B5E2F2A2CFD6616A765FCB57A79888FBC806DE27461B6A9BAF6433EFBE56
Malicious:	false
Preview:	sdPC.......................^u..L."....D."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................d5b8acc4-87b0-488e-9745-d801330b6c9b............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0f0ef307-9fbb-4827-80c2-e4603f905e3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\32a31a0b-2fcb-468f-94db-aa09a7fac9b5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.566160498175521
Encrypted:	false
SSDEEP:	768:NBPES5WPhVf+U8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+b3BvrwXpGtuf:NBPES5WPhVf+Uu1jajTBcItU
MD5:	D3AD376CF6A27BD10049B0E6E731E1D2
SHA1:	C417C63DB7E879E6E3D57A6BE051D7227DEDCDE3
SHA-256:	7E9214C35D545DB5423DA508F14A265E11308738C9A9AAADC8051C89DB8D63B2
SHA-512:	7D4F524B25F027BB8F4A7539DBE9ECA6D1F0F7DA511D30697FF6E9339BC6D08B6CDE81AA138B34030D13E9FD92911BCCD24903BC42FE01150C9E7CC3939ED94C
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369897314854481","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369897314854481","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3499926b-bfe8-4d90-9242-3ca38296ab35.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\41adcc63-55bd-43f3-b586-ec20864bcdc0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6424
Entropy (8bit):	4.974961045407686
Encrypted:	false
SSDEEP:	96:sthqfjVis1ib906dN8zM5s85eh6Cb7/x+6MhmuecmAexy8TQ52Mm/EJ:sthuss0dNkM5s88bV+FiARPmMJ
MD5:	DAB553A824917682FB6BC28C00238B88
SHA1:	A46E3B0E70C113D55F11526FD8AA56FCBD46965C
SHA-256:	0DF48F51E5FF230C2308DEAF20DEBA18CD3F2B2ACE07907692F0E363C3391ED3
SHA-512:	0CC9FCC373C6157BD1D453FF181D983E588DDF0519A5362A64D3E94E72799420EBF75AFA7173C42A9C1BBA329BEDD45048B74872478129EE49D846FEE0D13BC4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369897316639407","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369897315310756"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\9f82d714-ae96-4afe-a175-3ea79b1d4670.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.967403539058377
Encrypted:	false
SSDEEP:	96:sthqfjVis1ib906dN8zM5s85eh6Cb7/x+6MhmuecmAexUT52Mm/EJ:sthuss0dNkM5s88bV+FiArPmMJ
MD5:	70913CF175AFD6EA649F6EBF77A41E83
SHA1:	9B1476654C6B2659F69F1BBF72BA55E84D6DBA3F
SHA-256:	BA2F8005D1C6DCF88C30973168453A8CD37C60F06BD2A3A04603E5BD61288F29
SHA-512:	D89F573A9ADF6C42A21BFD69EF8DE6EA33A758337E36234A77CB3E26E3DADE88C2D7C8F2999F2E16E83427DA3B9E8232205DB3EB80BA014EF172A21B84A31B52
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369897316639407","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369897315310756"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.32165498794679
Encrypted:	false
SSDEEP:	192:5AOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:COEOKSXs/J7mGnQmLu5/5eNdl
MD5:	BA6F7EAA32530489AABBFE7C40395F1B
SHA1:	2300F25CD137A6BD840A714068B7E5E0B3713A91
SHA-256:	D611EA7809187648E92CCB75E9F783E74FB6CE1CEACA31FA0DD15818E4E4C308
SHA-512:	88AB45C58CCD73869CFB9D958857906F4D17492DF75433438200075B7095C2121C4FD1DA3EA557152D19B61F4DE174357219CD4266F2B7EFF3603D2F82FF7576
Malicious:	false
Preview:	...m.................DB_VERSION.1..................QUERY_TIMESTAMP:arbitration_priority_list4...13369897320418102.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.134798620655539
Encrypted:	false
SSDEEP:	6:PqbXq1wkn23oH+TcwtOEh1ZB2KLllqSCN+q2Pwkn23oH+TcwtOEh1tIFUv:PqBfYebOEh1ZFLnqSCIvYfYebOEh16F2
MD5:	6840ACDD7C0D434B12314F3D95686561
SHA1:	2DD1DE69AF64E84B34F2168AE60014152CA5666D
SHA-256:	BEA4C91B2F7B9A5D445919FC48670F16E69D9996F12927D151F0BA28034A9456
SHA-512:	6D0408F8240311F0B1EF53CE81693C0F04BF2168516F9F26E28379F06D129F27FE53A5433B6FCC55F79C434449BA48521308BB01A0F1EE367B13C2F4DCDC5C81
Malicious:	false
Preview:	2024/09/04-00:21:59.629 23a8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/09/04-00:21:59.703 23a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.044188898678037776
Encrypted:	false
SSDEEP:	6:/Fii2AXkM/lDmaG3KS4+SSpFe+kllP+vK0R/lJt:dX0EA6mSSCz/Pkb7Jt
MD5:	99A72FFEFA49DA0F7F876D2CE7FEAABE
SHA1:	496F7E20A98DFD14445556B7481DBF12C4AB67CB
SHA-256:	513E634FAEFBB0B453C33B9E8C7F4C03709BC05F1162D40DB4B7D3DB6CA7DA58
SHA-512:	1F16EDD658466F682A2832E01D45F59C60C994331B8549B584FDD4FBE7DF86B208DEEE91E857FCC91F3BEFD2718629CBB6C5A9B680123239ED679E2D46CB3254
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09573388097522217
Encrypted:	false
SSDEEP:	48:lVV4A3esQy5V4XesrAzNUeqtErg//nT3lWp4:lVV4A33Qy5V4X3rAzNLSErg/b3L
MD5:	D88C9040B0C9E2EABD387FEE9E2009B8
SHA1:	459B7D8FF2585B3737A0C7EC8AE6EEA6AB34B0E2
SHA-256:	3C2B6724C58448EB799C6463AB865C0840A1700AD56EA37998EDCA0F3D545627
SHA-512:	943F373B52904CA4D110EF95B176F3A40FC2003FF4B409D5EF6CC01017E61ECF19C898E598C18A7CA293BC76F151A223D4BADA0241AD17927684AC41D9376160
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.28323254310566415
Encrypted:	false
SSDEEP:	192:FX6UUqSxJZbtMX1X6UUqSxJZbtMXeXUE4Jl8/JZbtM4pXI4Jl8/JZbtM4K7ZX88z:gwSPJtMwwSPJtM1GJtb3GJtbo7JtL
MD5:	B18967142CD12C2C7D16284272DDCA76
SHA1:	8AA698FAC63FAC944BBAF18DE93538FC6201F5AC
SHA-256:	7701A72413CC356EDE01BFE87C46D46438E6DB43460A22206D27E3B3CF68C981
SHA-512:	E46A112576D71477720A869E1C77E396D845CA2F46DC98B467DA74C309DA35E8F03E4CC18BBEC09CB6DC185C7CD8B8ED843090BFDAB79780602A7B592557CF2B
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsulo8T/:LsB8T
MD5:	99A4E44359779DBE339439B1788231B1
SHA1:	2F971759CCAED0F145ACD2AFC488A53524DF5984
SHA-256:	25F53C89B4D86E2C929432A899C8BB1F6FF5233B489859B45390752492C9C700
SHA-512:	E7265D6325414155842C444140C8C73EAAE245E18C5BD9334570F2A9C0FBC52D1F92C1074CDC6E8157616CA512C3F9163C380DF70944BBAA41515C458CB45560
Malicious:	false
Preview:	........................................X.=.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:foKc9ERls:wKR2
MD5:	6C27B6C62F142C1D9CDF6115C13CE226
SHA1:	E492ED4363A68FDFB3028DA7E2D4CB2A86EE4DA3
SHA-256:	4915AE953566B48C1552382F59D7C7DB76F97911B77981BC33268FD205C59458
SHA-512:	5B0CFCD7D65A8D5C6F6B5193F81BD49B602E69A17D8587A3BF8F20A98CE0C81A5C3675909B0803397557B7A110EE4D015F579F41AAEF67E8310E2F6DFBE6A50C
Malicious:	false
Preview:	(...B.moy retne..........................$.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:foKc9ERls:wKR2
MD5:	6C27B6C62F142C1D9CDF6115C13CE226
SHA1:	E492ED4363A68FDFB3028DA7E2D4CB2A86EE4DA3
SHA-256:	4915AE953566B48C1552382F59D7C7DB76F97911B77981BC33268FD205C59458
SHA-512:	5B0CFCD7D65A8D5C6F6B5193F81BD49B602E69A17D8587A3BF8F20A98CE0C81A5C3675909B0803397557B7A110EE4D015F579F41AAEF67E8310E2F6DFBE6A50C
Malicious:	false
Preview:	(...B.moy retne..........................$.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:fF0KPyEJ2L+:CK1J2L+
MD5:	2344F7E518E5D8632C5B8C2512D90DF0
SHA1:	D1BE64C842C07939E079FE0DA82510D983E8D6F4
SHA-256:	7081A90E0A0F480124BC2C8F7420BE30D8CE1D93BD10348D918B39012D902071
SHA-512:	2A5276DED9EA364EDDC8178CEE0454A755A2CC8E4F61F26826248EE5F62FB740DC421FC9F503A1A771F9D96DC617E15008AD6CD0DFBB35142FE965892063504E
Malicious:	false
Preview:	(.......oy retne..........................$.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:fF0KPyEJ2L+:CK1J2L+
MD5:	2344F7E518E5D8632C5B8C2512D90DF0
SHA1:	D1BE64C842C07939E079FE0DA82510D983E8D6F4
SHA-256:	7081A90E0A0F480124BC2C8F7420BE30D8CE1D93BD10348D918B39012D902071
SHA-512:	2A5276DED9EA364EDDC8178CEE0454A755A2CC8E4F61F26826248EE5F62FB740DC421FC9F503A1A771F9D96DC617E15008AD6CD0DFBB35142FE965892063504E
Malicious:	false
Preview:	(.......oy retne..........................$.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl3Bl/:Ls3x
MD5:	73E1576F1534D113A40DC27546AF440D
SHA1:	6DC9000ECF8735FD3A190B40EE4E05E467F74C5E
SHA-256:	BB7CB99BE887AB63D1FE8698BFE8971896219E0D2777528CA94BBC042D5C739C
SHA-512:	DBF3F70F2A43C847527E1927F9787BD1B7407249921164A47BB3DCA6363BD922AE881157AB90B2476F1581A06BE8406AEE8DA714F937277775F69472866BD74C
Malicious:	false
Preview:	........................................"EB.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354063257451229
Encrypted:	false
SSDEEP:	6144:0A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:0FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	018425F38AE1B53FEE68BE806D21D88A
SHA1:	E34D9182E25CD57ABE8C01723C919810923A8945
SHA-256:	DD2AC809A2262B5EB3B172DE2095D2835246FE9B8841D2C498B81E75F131E68B
SHA-512:	38D1977A2F4BD07596D1920A6BE4FB96EAB113441F32D96B71EF9A17FB06ED94DB6B117A959F8BEBBA150DE28B14EABE6B4A9580459CACDBD35743D289E9F7B4
Malicious:	false
Preview:	...m.................DB_VERSION.1N.~7q...............&QUERY_TIMESTAMP:domains_config_gz2...13369897320492589..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.193065502510573
Encrypted:	false
SSDEEP:	6:Pq0XF1wkn23oH+Tcwtj2WwnvB2KLllqS8vIq2Pwkn23oH+Tcwtj2WwnvIFUv:Pq0ofYebjxwnvFLnqS1vYfYebjxwnQF2
MD5:	83149AF30751482FD996DC1428FAC391
SHA1:	2BBC45A13AB739DAD1F28FDCD28A3986DB1A9035
SHA-256:	1A377CDF961C6AD5CF608477CBF716CEF1797B5B46BFEA3AEE489D09B3A7889C
SHA-512:	30DE6334406EE9497C05F5F1D05B00950A70371BD567310DD515CDCA653349DBD387B09AA7C6171A1AFA94E8DE7B5714ADAD035F67723E9B8601CBB25FD34FF3
Malicious:	false
Preview:	2024/09/04-00:21:59.632 23c0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/09/04-00:21:59.794 23c0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324616216568578
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rr:C1gAg1zfvj
MD5:	291F841DD1F68E8496402552164BBE8D
SHA1:	A73E1AA3EBC6A7397C5B0420431A1D9D8A8F8C36
SHA-256:	ED87CA46E0818D152B3B0D8D6303E09B86FC88623320C2A58BF088517DD72C40
SHA-512:	2AB6D9CA0EE368C0ABBFD212B8E81A7B80A1F8774DF823016AA4CEB5A54B97C0EF4E49F4A29A44FAD8CAEC4B04A3650A79274035F1E214DE82D238982CA823E1
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.138660261847179
Encrypted:	false
SSDEEP:	6:Pe/uRmHM1wkn23oH+TcwttaVdg2KLlle+q2Pwkn23oH+TcwttaPrqIFUv:Pe/uSrfYebDLne+vYfYeb83FUv
MD5:	78C124D54282B1189FAF011E899FC201
SHA1:	7B8DF6AEF6510ABEC13E372DE4D3ED42CCCDB8F9
SHA-256:	46B0CCCE3E4B376D0EC76205D9EB78B2A7AF606E995F0B5FA58AA28A6D2B27DD
SHA-512:	77FF42344780E7F87C26120B188853EDF61630966683DEC547B0DAAE7D21DC3DABAB0DDBBD19E27B7DB7951112BFA06AFAB6B3AF6E64073837FFCFACEFA19EBF
Malicious:	false
Preview:	2024/09/04-00:21:54.900 1d44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/09/04-00:21:54.925 1d44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.140169675768787
Encrypted:	false
SSDEEP:	6:PeNFrHM1wkn23oH+Tcwtt6FB2KLllezbq2Pwkn23oH+Tcwtt65IFUv:PeXTrfYeb8FFLnezbvYfYeb8WFUv
MD5:	22E89FD33807C6B67AF7D8E675047D35
SHA1:	771B5142D085531AD6612AB15119203D72194A7D
SHA-256:	F44FF97FA90535364A400324B79F03EE9531E21060CB3E03DC095FBD530D1CA3
SHA-512:	E85C381568C170C97860957D96EE062BA69AAC60061B3E93FB8A6F0D3A20CB22E4D9D5912E888212C7387F3ABEDEA969DF769E28B49577C9CAC6C980192C68FC
Malicious:	false
Preview:	2024/09/04-00:21:54.928 1d44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/09/04-00:21:54.940 1d44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.17581003390338
Encrypted:	false
SSDEEP:	6:P5GP1wkn23oH+TcwttYg2KLllXQ+q2Pwkn23oH+TcwttNIFUv:PY+fYebJLng+vYfYeb0FUv
MD5:	E7C55E9016C2726BAA1E975BC94D30AF
SHA1:	5C406975768B3FE863B76C013FB835AF901E2570
SHA-256:	45094A03058BE48D4747DDED3917827125C877348D02781BE08B0B7721016D41
SHA-512:	56DC51A69A42FE5E2A99870C2AC8874AC09A9BA31BCCCB2FE6B6C58A085CD3F0EFFD7220EFBB507CC1E24A68EC3B808D893AF8B984A61B125D0ABACC2049446A
Malicious:	false
Preview:	2024/09/04-00:21:56.841 1c3c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/09/04-00:21:56.854 1c3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlNpl:Ls3Np
MD5:	0D0450F5AF14ABD4FE0FFDBCF95FE067
SHA1:	CE5BE53AEB004633803D9949ADCACB3A81036F11
SHA-256:	0751CEF89A603B76D17948932F1732F623DDAEF43446AF24CA498A2F442DB0AB
SHA-512:	067D569BBB90DD51A59B7DD1665A4E728DACCB8A6DAB424DD43A27317F896963BCC24FA11FCFB388FA1A265D4B457061BFD1906FDC6FA6D3926ABB9BC181D2A4
Malicious:	false
Preview:	........................................k@>.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:qtFlljq7A/mhWJFuQ3yy7IOWUeudweytllrE9SFcTp4AGbNCV9RUILln:B75fOVd0Xi99pEYRln
MD5:	DD741FC965E72029F5E4B77824A2EA25
SHA1:	63E53476786CE15463DA2397D63E31F388BE339A
SHA-256:	11392BFD3A1D88A87FC76C35168C62D28D1021A77ACD5838F9A6F02C7E7D7556
SHA-512:	785FA575976961ABB9A3CF619AEFF54F5F22E14DAAD437F7680A558BF9920B77B406E3D5A7564BBED32637861152FFDCE3014E69F2A9F25EED80DE185C1273A7
Malicious:	false
Preview:	.............w.@...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.225696793754196
Encrypted:	false
SSDEEP:	6:PovvcRq1wkn23oH+TcwtRage8Y55HEZzXELIx2KLlloGt+q2Pwkn23oH+TcwtRai:PkcbfYebRrcHEZrEkVLnvovYfYebRrcU
MD5:	06F9A75ED29E91B6B5735BA32B70BF74
SHA1:	FFCB07070174FA977AF3724E46BEDF85A9603132
SHA-256:	544A4D059BD2F80B7A5E2CA4373A18676539D8E73C9843BCA5045E8A66F9F1D2
SHA-512:	5FBD8318A035DD8AC43E13F629A0FEF90E90FF105DF8781CDD31B270A45180D5FF1ED83D96894001EF5858897ADE874EEFE710324C5F730DB80DF1827453D39A
Malicious:	false
Preview:	2024/09/04-00:21:57.799 1c18 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/09/04-00:21:57.811 1c18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.165686332198295
Encrypted:	false
SSDEEP:	6:POk1wkn23oH+TcwtRa2jM8B2KLllOh99+q2Pwkn23oH+TcwtRa2jMGIFUv:POTfYebRjFLnOhn+vYfYebREFUv
MD5:	67BD2DC488A17A423934ACACA0A6EE3A
SHA1:	5322D30241ED13AAD2468C9FF2FE72873653D0E5
SHA-256:	E6E4A8D4B73E90B5D28C528A5FC491346A584BBE72768B9499322857AF694BD4
SHA-512:	8B4F643AABD71E2079FCD7C64EFF7B90917C50CC0A733A3082BF2777DB9AB3C02E4396F6D505A1D2AD7225251518E5FC69917CBE38F94D6E601CF5028376C36C
Malicious:	false
Preview:	2024/09/04-00:21:55.704 fec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/09/04-00:21:55.842 fec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\07aa2c3c-07c6-4c01-b16d-dcc799114d01.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\9f7117df-bf5e-481a-b64e-6a94df7b1674.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF3b77a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.761095351364057
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkOf:uIEumQv8m1ccnvS6l
MD5:	F2DF7577B17C4BBFAB770FCC6B59528F
SHA1:	57E84ED3F1969E925FFD3AE56F78969E7B67F4EA
SHA-256:	A7D18E500EB52B8181BD3B8DEF710A21990739EC7ED21492ABAD531F316A7F3F
SHA-512:	FB0FF2F36FCDDE9792B43E351A70BBB8599F6DC303527E333E810AA1049078E378DBADC4B5D8F0DC7521B405EF1CE639AFD70684925933AF9963973AF2606833
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF2961c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\ab08b069-fb7b-4cf8-8845-fc085c731756.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\c02fa8bf-46cd-4a3f-b3c7-5f87f539deb9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\d1427e06-5725-49aa-9981-e9b953627ec7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.967403539058377
Encrypted:	false
SSDEEP:	96:sthqfjVis1ib906dN8zM5s85eh6Cb7/x+6MhmuecmAexUT52Mm/EJ:sthuss0dNkM5s88bV+FiArPmMJ
MD5:	70913CF175AFD6EA649F6EBF77A41E83
SHA1:	9B1476654C6B2659F69F1BBF72BA55E84D6DBA3F
SHA-256:	BA2F8005D1C6DCF88C30973168453A8CD37C60F06BD2A3A04603E5BD61288F29
SHA-512:	D89F573A9ADF6C42A21BFD69EF8DE6EA33A758337E36234A77CB3E26E3DADE88C2D7C8F2999F2E16E83427DA3B9E8232205DB3EB80BA014EF172A21B84A31B52
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369897316639407","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369897315310756"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF325e8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.967403539058377
Encrypted:	false
SSDEEP:	96:sthqfjVis1ib906dN8zM5s85eh6Cb7/x+6MhmuecmAexUT52Mm/EJ:sthuss0dNkM5s88bV+FiArPmMJ
MD5:	70913CF175AFD6EA649F6EBF77A41E83
SHA1:	9B1476654C6B2659F69F1BBF72BA55E84D6DBA3F
SHA-256:	BA2F8005D1C6DCF88C30973168453A8CD37C60F06BD2A3A04603E5BD61288F29
SHA-512:	D89F573A9ADF6C42A21BFD69EF8DE6EA33A758337E36234A77CB3E26E3DADE88C2D7C8F2999F2E16E83427DA3B9E8232205DB3EB80BA014EF172A21B84A31B52
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369897316639407","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369897315310756"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF39b08.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6290
Entropy (8bit):	4.967403539058377
Encrypted:	false
SSDEEP:	96:sthqfjVis1ib906dN8zM5s85eh6Cb7/x+6MhmuecmAexUT52Mm/EJ:sthuss0dNkM5s88bV+FiArPmMJ
MD5:	70913CF175AFD6EA649F6EBF77A41E83
SHA1:	9B1476654C6B2659F69F1BBF72BA55E84D6DBA3F
SHA-256:	BA2F8005D1C6DCF88C30973168453A8CD37C60F06BD2A3A04603E5BD61288F29
SHA-512:	D89F573A9ADF6C42A21BFD69EF8DE6EA33A758337E36234A77CB3E26E3DADE88C2D7C8F2999F2E16E83427DA3B9E8232205DB3EB80BA014EF172A21B84A31B52
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369897316639407","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369897315310756"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566171800292138
Encrypted:	false
SSDEEP:	768:NBPES5WPhVfxU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+b3BvrwzpGtus:NBPES5WPhVfxUu1jajTBcEtv
MD5:	4CEB98E2D6DCC3CCC5C0D6D223629CA6
SHA1:	21C5C5784BBDE39523E94407D442D6EF786A189F
SHA-256:	E0252EA923DD131FBE6CB008151C4778568214F417AF997CF467D51A555AD1BF
SHA-512:	97ED1607E0D32AC120B8AD520A471AEDEE5885905F469C8E76D138842FEF170F3183F15E026E1B8E145EAE2F932576130E8F71D253032F3C7854A23A2B7CE6B4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369897314854481","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369897314854481","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF2f62d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566171800292138
Encrypted:	false
SSDEEP:	768:NBPES5WPhVfxU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+b3BvrwzpGtus:NBPES5WPhVfxUu1jajTBcEtv
MD5:	4CEB98E2D6DCC3CCC5C0D6D223629CA6
SHA1:	21C5C5784BBDE39523E94407D442D6EF786A189F
SHA-256:	E0252EA923DD131FBE6CB008151C4778568214F417AF997CF467D51A555AD1BF
SHA-512:	97ED1607E0D32AC120B8AD520A471AEDEE5885905F469C8E76D138842FEF170F3183F15E026E1B8E145EAE2F932576130E8F71D253032F3C7854A23A2B7CE6B4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369897314854481","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369897314854481","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.076234537776263
Encrypted:	false
SSDEEP:	6:PHG51wkn23oH+TcwtSQM72KLllHGgi+q2Pwkn23oH+TcwtSQMxIFUv:PHNfYeb0LnHK+vYfYebrFUv
MD5:	FB822E235C9D2C1E415289594B2AC0BF
SHA1:	6DC7AC8AECA54BB4FFBD1035D9D9856B5A73BFC0
SHA-256:	EF022C3DDB84CF209BD6FE8515636C1811AC72C6BADC9228130875BE22CF642B
SHA-512:	9E354CA7B387168C4D630CF0618A519CE94B13B1125FEEF46A7C19E49470DC88C4EA9EC5881E846D7758EACDFCB50CC7AECC5063DA385D7F48E8046253CC677B
Malicious:	false
Preview:	2024/09/04-00:22:12.703 fec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/09/04-00:22:12.729 fec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.093024412349507
Encrypted:	false
SSDEEP:	6:PeyfRRM1wkn23oH+TcwtgUh2gr52KLlleXFf1q2Pwkn23oH+TcwtgUh2ghZIFUv:Pea3rfYeb3hHJLneXFtvYfYeb3hHh2F2
MD5:	14E15C13DE17E2E380A3B52ACAF01F96
SHA1:	411F86257DDE0B23AD5B53D635020EA81B9D22B0
SHA-256:	74E8C8C4B96EA33480FAEF5C345D0F60B00D317F89B371733D5B84EEE7211373
SHA-512:	7274472D15C2F7E69E425269D29780AE819C1428B61933A0C340D4F1E6761C4B8622A584609AB4C24A2077B684F2C01B1192157EABA3A740A865B363FAD35C3A
Malicious:	false
Preview:	2024/09/04-00:21:54.970 1c54 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/09/04-00:21:54.980 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsul1Lal:LsD
MD5:	12D1435D4F4A822951FA295D5EAC6EC6
SHA1:	A993DA8237281C8A455C62DE0660AED1DF999E67
SHA-256:	962E036D7E6286696EB275E924229387B7356CED010B81A6724ABAA2D947DB0E
SHA-512:	E53B0819E5F91425BB13583B262144C17D75910E8771546A1334F473491EC9F296FC40996155A82F1092037E39C89DF4A2271F08DCC5B93DC422B0B2E16A4679
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:2uAJtAR0EDtBl:2UDtT
MD5:	6843C18A2DC12E5D39302BC8EBF966B6
SHA1:	DF5A4577A08D4E9F483E7B42BC71BBD0FD322158
SHA-256:	82A1D175504FBBE73801812787D11F9369CC9EEB46D89920458C67F105203587
SHA-512:	68419330E02ED3D8E9EF933AAEA52D109935DE679FB99061937E79E61F95DC443C0FD3DF65D89DF91C4850238F06988C17313C1A0FA9FC2496D75243A4B3FA0F
Malicious:	false
Preview:	(.....%@oy retne.........................P?.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:2uAJtAR0EDtBl:2UDtT
MD5:	6843C18A2DC12E5D39302BC8EBF966B6
SHA1:	DF5A4577A08D4E9F483E7B42BC71BBD0FD322158
SHA-256:	82A1D175504FBBE73801812787D11F9369CC9EEB46D89920458C67F105203587
SHA-512:	68419330E02ED3D8E9EF933AAEA52D109935DE679FB99061937E79E61F95DC443C0FD3DF65D89DF91C4850238F06988C17313C1A0FA9FC2496D75243A4B3FA0F
Malicious:	false
Preview:	(.....%@oy retne.........................P?.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.8981641637663254
Encrypted:	false
SSDEEP:	3:6LR0E8Anpa:6L9Bs
MD5:	4D34A5C7E69F1683E76AD6DE89BCCC08
SHA1:	7B05C9A5E6DC80149A393240894D92E29C5DFCA2
SHA-256:	8A282384241B50361DF02ED21923DCEAF208CAD7519B35621844C2A2E5B198AB
SHA-512:	29D6D405C99D2291CA6FA14B9DB2CEA92011825BAF27D343AE52D1E84245BE82ACD1BC334A330A5FEFF0F4E413C607372E6672C101D1A8605A5A624EC0C17543
Malicious:	false
Preview:	(....+oy retne........................ eB.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.8981641637663254
Encrypted:	false
SSDEEP:	3:6LR0E8Anpa:6L9Bs
MD5:	4D34A5C7E69F1683E76AD6DE89BCCC08
SHA1:	7B05C9A5E6DC80149A393240894D92E29C5DFCA2
SHA-256:	8A282384241B50361DF02ED21923DCEAF208CAD7519B35621844C2A2E5B198AB
SHA-512:	29D6D405C99D2291CA6FA14B9DB2CEA92011825BAF27D343AE52D1E84245BE82ACD1BC334A330A5FEFF0F4E413C607372E6672C101D1A8605A5A624EC0C17543
Malicious:	false
Preview:	(....+oy retne........................ eB.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlbtp+l/:Ls3Jp+
MD5:	5F8E0C7726C526B2FE7A79C60F75F47F
SHA1:	E1E705A1F0275D698668A9BE6AA829197079A2F1
SHA-256:	197C1C9FA0544A74FCC0E4896B4935FAF4CF041B266ABA418BC3F7488BDE42D4
SHA-512:	C07F54859335A92BB145F8FEF58340921CC2966769015FFFAE5A15698BBAA71EBAFBE883806972C655712CF3C33408B92D72A5F5ED0DF2DDD4D9A63DE6DAC514
Malicious:	false
Preview:	..........................................H.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlVkt:Ls3Vk
MD5:	AC6A2F7D0501A7EA048D1C0B0D019515
SHA1:	81ABF9987148E87C5D1CD17E475053BF88B7FD08
SHA-256:	B7AF8FC89248D8A122C2B11CD9B5BCBF4F3950E061470E8B9876778A8104A99F
SHA-512:	3A5979C1F685FFABE0147877E60F8AF8A30D2EF4BDB902727A54E189645C5AF7815F26C3B9EC9CDE0B81816BB17817854059E9AE921CEFC6472515FBC4ED7B00
Malicious:	false
Preview:	..........................................D.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	401
Entropy (8bit):	5.191406509437048
Encrypted:	false
SSDEEP:	6:PV1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLllj+q2Pwkn23oH+Tcwt0jqEKj3K/2jMY:PIfYebqqBvFLnj+vYfYebqqBQFUv
MD5:	324A40072B65E28A6B906DBB0358809F
SHA1:	D610E64064AA0570DC37BC940B08EC3767F1BE54
SHA-256:	4FB262979DD88D0C75EB6B2A0EF997EF699B88A0DC26EF0026AEDEE7953E7EA6
SHA-512:	C21303144087D73B4E27E151F0B6A6040DE0AF46FD501AEADD87058275F4EE537DB198C16EA66EDBC5DEE45173FF33DD809588F5951B34FFD84F01A4E7EBA157
Malicious:	false
Preview:	2024/09/04-00:21:56.840 fec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/09/04-00:21:56.884 fec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\37a8f8f7-25bb-4f1e-8f16-e02c3e9de2a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\79cd9d1d-0685-42a6-8b93-263a4dca4bb9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9ab730c4-ecf4-451e-84d2-a2cd16301330.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3b8c2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\eda050da-42a8-4a6a-a4b5-7f301e886339.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.169900008160733
Encrypted:	false
SSDEEP:	12:PHiQVfYebqqB6LnHiQ99+vYfYebqqBZFUv:xfYebqbLXcYfYebqy2
MD5:	A53CF17967AE0F738DB0656D42345678
SHA1:	35B9DCF281AB1CA5EA44CE47A47F8098674B24E4
SHA-256:	F3E9B4742DC363844D04774F9FE97D5BA4688D4C652A40F5D6DCD19DC7E4C5EF
SHA-512:	796702107AD6ADD47E88DD437F727660DAE32A2EDBCCF836C639D2CEE5B4B2B5E2EE40BB4655C03DE9E6B7CEB54AF125B1C84D714364371C5186C8B1E1F2881C
Malicious:	false
Preview:	2024/09/04-00:22:12.655 fec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/09/04-00:22:12.687 fec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.226004374655443
Encrypted:	false
SSDEEP:	6:PvZuM1wkn23oH+Tcwtkx2KLllOjNFIq2Pwkn23oH+TcwtCIFUv:PvErfYebkVLnOZFIvYfYebLFUv
MD5:	41869DFE89D6D21B1F06D42FAFB2174E
SHA1:	91476C2CE7427C151C485C5006DCD68695C813BA
SHA-256:	73EA2F203F8F99A14E90238D583DFB455E2BCCB8F1B5B739145CDB731B77B336
SHA-512:	70F7447A799B16A1092AF99D6F746675B52403EC686C924C9CA0EC2B434CEB4A292599CEAA5CD80B5B7D786831BC75A14FA9A7E9CE025779F98694574B764E65
Malicious:	false
Preview:	2024/09/04-00:21:54.893 1cf4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/09/04-00:21:55.178 1cf4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002080071924522469
Encrypted:	false
SSDEEP:	3:ImtV/0v//:IiVc
MD5:	276F7E4D8B7292947A13F5E1FDECE7FA
SHA1:	633ED039C70B358F43BD3A781A164CF4BC17CC07
SHA-256:	FBA000CF06FFADC45F708847983299BCD5F0CB0D6BB8A60BFB2DF4C5A3B7B8B0
SHA-512:	CF02CE8B7006708B38BAE6BD52D4F1CDCBFDD0CA738BE68E1D5FBD5AF29F11E456A0028F73CB97E28710107A0735A6B3373D810BBA531CA0E3B2372B89748E1A
Malicious:	false
Preview:	VLnk.....?......\|.L...:8................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0771994721519702
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOvSAE+WslKOMq+vVumYvx5n66:e/2qOB1nxCkOvSAELyKOMq+vVum6hp
MD5:	09EC13E711C906BDA088AED0BBA0B600
SHA1:	84353E2406DAF1DDC40FB91D00D6CD32D3B78669
SHA-256:	A7E21CEBFFA074E55264F140E2C8BDBF18CE7B7C88118001AE80ADCD41E4A634
SHA-512:	F2E2E426694DE9B4FDD6216BA07124AA64FB285A58BD78995BA77E31C5703F48F8B2442AAD715A0696BD8A55C21721472AF0A48663BEAB33CD831532D4F90D47
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\c104e9a2-8f70-43e1-9f7f-555ad470e465.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6526
Entropy (8bit):	4.977169244132992
Encrypted:	false
SSDEEP:	96:sthqfjVis1ib906dN8zM5s85eh6Cb7/x+6MhmuecmAexOznQ52Mm/EJ:sthuss0dNkM5s88bV+FiAqPmMJ
MD5:	71A43D6753A95786DD2AE7D805CE3576
SHA1:	C5D539578C0E43F15FEBDD574A468E1C81E07392
SHA-256:	7AC44842ED09B2FBAA183FCD6F1997DF66BC7BD631DF094A2221069696A3DFA1
SHA-512:	7025E84CB0A54269A158FDE91AB6CB293075A55725AF2A6AF6402ED8B1F7324A06D848D8C75F433EC29399A1CE9B40FB919D98BB9A862293CB4CB0A6506144FA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369897316639407","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369897315310756"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\f2d2c1f6-8b2b-41f4-a448-891ba3bca035.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566171800292138
Encrypted:	false
SSDEEP:	768:NBPES5WPhVfxU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+b3BvrwzpGtus:NBPES5WPhVfxUu1jajTBcEtv
MD5:	4CEB98E2D6DCC3CCC5C0D6D223629CA6
SHA1:	21C5C5784BBDE39523E94407D442D6EF786A189F
SHA-256:	E0252EA923DD131FBE6CB008151C4778568214F417AF997CF467D51A555AD1BF
SHA-512:	97ED1607E0D32AC120B8AD520A471AEDEE5885905F469C8E76D138842FEF170F3183F15E026E1B8E145EAE2F932576130E8F71D253032F3C7854A23A2B7CE6B4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369897314854481","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369897314854481","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/ME///lFll:7+/l/J
MD5:	6300578D23D7FEC97AAE2E3FEFDBF8CD
SHA1:	12DA1A6E1BECD0856E9262DFD3C0E535A850DE23
SHA-256:	EDC2515D219F132BDCEBC37F1751A6CB5A5F5E3C5C24C9EAA193A7B98B4EF6DF
SHA-512:	F7A1FF9D6418CE32CE7E917B603CDCC4BA53FBA9C497C1D988648C07EAD75F4585EECDA02C4959E016F807151800222F13DD68768BCFD27EEBD916A5447E4B04
Malicious:	false
Preview:	.... .c.....i...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.05010601478646411
Encrypted:	false
SSDEEP:	6:GLW015R21TW015R2/L9X8hslotGLNl0ml/XoQDeX:a1WB1WBGEjVl/XoQ
MD5:	43C57AB1738B49DE73661423685871D1
SHA1:	059292955F59CE510589C0C2D64ABF83885B8D96
SHA-256:	CA7537DADB3B15E33A6354177194ADCC78253375F8CA31AC3A6FDC1DBE24A953
SHA-512:	60FDECD120B528C65B9A216307B30E668A424CEA24B9056CB123328859CD3B60A6EAB71CB80725E19C51004E553461F9B3AAB285E6C2489738FB8B817DE2B63D
Malicious:	false
Preview:	..-.......................U .uK..Lw-M..RGF........-.......................U .uK..Lw-M..RGF..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9970062624315037
Encrypted:	false
SSDEEP:	48:IrzxTlIlO+pgcbX+mn9VAKAFXX+L52VAKAFXX+BxOqVAKAFXX+NmnUYVAKAFXX+x:IPxT6EfNsLnNsHO5NsNBNs5/P
MD5:	CA48A811ED7BB8B796A7AA5300F29002
SHA1:	22E1A4A12FABCB654D6738D99656B3F8295437B2
SHA-256:	45C5338C20FD813CA84F572E1268135AB7D6B879EF82F89C65D55D5F06505602
SHA-512:	22D85B293E84C1FCAA03BF6877D6178F6B704BC1A04134B529962D2EC5577A99EF57C885DDD005E6B271F300DF56ED0B229529B428825CA0BBA2122DAF663D2A
Malicious:	false
Preview:	7....-...........Lw-M..R.^O...=..........Lw-M..R..$.(...SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.4949840625581166
Encrypted:	false
SSDEEP:	48:D98TSBSqQclUP+HRHoxuIYjIYczcqkNMYjMYBy7AlkfAlkd3:V0qQaIYjIYczcbNMYjMYoYcYw3
MD5:	BB228AA634E6AAE3D57034340086F2BD
SHA1:	23C81CEA7542E22ABA5E58C94FE5EA70D2D138C4
SHA-256:	8AD74FCD7AA34E7999AB791AE170C47A7CB95FBA7E42C15E2A59908FDB6B3778
SHA-512:	90412FA0E2B6705D0FCC62F462925F085BF7FCAC592CF2308CEBA2BAB63859FE4ED77E0215CB337E9B727EFEF332325E5729D12D332FFC4419291FAE6A9C2A56
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1+\Ie0................39_config..........6.....n ...1u}.=...............u}.=....................................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceT

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.192343946453596
Encrypted:	false
SSDEEP:	6:PODccRRM1wkn23oH+Tcwt0rl2KLllOcq2Pwkn23oH+Tcwt0rK+IFUv:POr3rfYebeLnOcvYfYeb13FUv
MD5:	1A7F33622FC81E5BF9162E5F60BD5C1D
SHA1:	A309366C5528E50D01136687226F057563C41F91
SHA-256:	B0A2F393AB5D11FF4D8CB664B89D5B078DB9780E7FA227CD0D55DB634FB070BD
SHA-512:	E15BCD1B7195EAB5667967590F55AFFDC82D6162D5699CAB26237FA3485D22C5F5E5EE7ADC0DD81719A11E9C55F3A351172E3CCCEE8F0C0B306AC5B5658E66A9
Malicious:	false
Preview:	2024/09/04-00:21:55.501 1c54 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/09/04-00:21:55.520 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.9474235088980287
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01z9Bge6Nqa:G0nYUtypD3RUovhC+lvBOz8
MD5:	A9E525858391955E377EF1FD6E0C73A1
SHA1:	711F920CC2ECF7A953F4181054B6029E73466654
SHA-256:	4A4763A9FA535D331A1CACC2D412054858B65D5B7710CB5AB2141DA93CDDF703
SHA-512:	D6FDDD41ACD7D4C5450BCD05B0E121CF3DA520EB684B0858F58CEFFE55AECE2A6DDD6DF8718C455674799AB9FABD098817F7C2B794490D3C920A21569E736665
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.......=6.................3_......\|...................4_......M...................3_......-D..................4_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.198255269998828
Encrypted:	false
SSDEEP:	6:POWuDmRRM1wkn23oH+Tcwt0rzs52KLllOz1q2Pwkn23oH+Tcwt0rzAdIFUv:POWd3rfYeb99LnORvYfYebyFUv
MD5:	3DE1ECDD9858B779D0ABCD2D5B7A29C3
SHA1:	BF6266D13AF4FC7DF16AD5F30F8CCAEA0EB721A4
SHA-256:	2D220FD9E46974673F520E74E55AB0C9E6E4462A7F9B963AF37F01400F904BA3
SHA-512:	47A9A64D6DA4CBDB6BDE2635BF350E54CA4393DA7CF9FC98E55338E44A33E99B4E976C1FC993D0FCD58D1E77A6831EB0DC9AB12D22C327DCD24A4ECE625DE49F
Malicious:	false
Preview:	2024/09/04-00:21:55.344 1c54 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/09/04-00:21:55.497 1c54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlUBt:Ls3W
MD5:	AC97F11EA8AC94C676480A43E7A86DC8
SHA1:	4D00D3B8229B4C97066B0838A3D2EF8B1AFA5083
SHA-256:	8E77EC1D425EB473B3E8CB2E1594082DB94ECA1DA73D2348F8FB79F50FDDFD4F
SHA-512:	A2E160F0BE2B1E9672C04422F1F11C0B8AD75D1F373E158B883851D60AAAF25BBB34A1BCE1A53EBB2964144D9F69A921E36D76C4DC470D3FC998E3FD752C9D2C
Malicious:	false
Preview:	.........................................=C.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNleM:Ls3e
MD5:	F651DDB09EE4D6607762BDCAC5FDFF2B
SHA1:	0A4A59FF2EE353614CDCCA7A245A787C29C05D57
SHA-256:	76B406D9ADA74929D29883C4D271F2796A7432A13423AB2AC333CBF08AE9C272
SHA-512:	51BF601668612A03A19621462B72B5822377227F07F9927AAFB4EE67676714905E2D998F11528F63BBC2536FCEBCC61184A1BEBD8A55AC68D013DAB8D30B9A57
Malicious:	false
Preview:	........................................h.C.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518716667362554
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtJ+QZtsynzu6yiksJdXBuBuwBxWa0KNhfTX2QQRCYfYg:YuBqDPafaGnzp7gBzBxWdMfTnB0
MD5:	8AF261AEBF3C2B903739D699E77B4ED7
SHA1:	7A61418F34CF27946D5313245839551D41C63240
SHA-256:	5C2BE8CB0BD4610DCEFE88FC3EAD70CF880E6CB740B4A71B33EE595CFABFD0D6
SHA-512:	FEB22BC1FDA35E68408CF5E9ACE200F88E759726FBC81DDD477CF10CB9E97107CA53445BD6A573EFE942634901CCB7D666CFBE5FFC2317693D8A50580109EF3C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369897314174944","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725423714"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF287d3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518716667362554
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtJ+QZtsynzu6yiksJdXBuBuwBxWa0KNhfTX2QQRCYfYg:YuBqDPafaGnzp7gBzBxWdMfTnB0
MD5:	8AF261AEBF3C2B903739D699E77B4ED7
SHA1:	7A61418F34CF27946D5313245839551D41C63240
SHA-256:	5C2BE8CB0BD4610DCEFE88FC3EAD70CF880E6CB740B4A71B33EE595CFABFD0D6
SHA-512:	FEB22BC1FDA35E68408CF5E9ACE200F88E759726FBC81DDD477CF10CB9E97107CA53445BD6A573EFE942634901CCB7D666CFBE5FFC2317693D8A50580109EF3C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369897314174944","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725423714"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF287e3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518716667362554
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtJ+QZtsynzu6yiksJdXBuBuwBxWa0KNhfTX2QQRCYfYg:YuBqDPafaGnzp7gBzBxWdMfTnB0
MD5:	8AF261AEBF3C2B903739D699E77B4ED7
SHA1:	7A61418F34CF27946D5313245839551D41C63240
SHA-256:	5C2BE8CB0BD4610DCEFE88FC3EAD70CF880E6CB740B4A71B33EE595CFABFD0D6
SHA-512:	FEB22BC1FDA35E68408CF5E9ACE200F88E759726FBC81DDD477CF10CB9E97107CA53445BD6A573EFE942634901CCB7D666CFBE5FFC2317693D8A50580109EF3C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369897314174944","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725423714"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28a35.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518716667362554
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtJ+QZtsynzu6yiksJdXBuBuwBxWa0KNhfTX2QQRCYfYg:YuBqDPafaGnzp7gBzBxWdMfTnB0
MD5:	8AF261AEBF3C2B903739D699E77B4ED7
SHA1:	7A61418F34CF27946D5313245839551D41C63240
SHA-256:	5C2BE8CB0BD4610DCEFE88FC3EAD70CF880E6CB740B4A71B33EE595CFABFD0D6
SHA-512:	FEB22BC1FDA35E68408CF5E9ACE200F88E759726FBC81DDD477CF10CB9E97107CA53445BD6A573EFE942634901CCB7D666CFBE5FFC2317693D8A50580109EF3C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369897314174944","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725423714"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF28a44.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518716667362554
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtJ+QZtsynzu6yiksJdXBuBuwBxWa0KNhfTX2QQRCYfYg:YuBqDPafaGnzp7gBzBxWdMfTnB0
MD5:	8AF261AEBF3C2B903739D699E77B4ED7
SHA1:	7A61418F34CF27946D5313245839551D41C63240
SHA-256:	5C2BE8CB0BD4610DCEFE88FC3EAD70CF880E6CB740B4A71B33EE595CFABFD0D6
SHA-512:	FEB22BC1FDA35E68408CF5E9ACE200F88E759726FBC81DDD477CF10CB9E97107CA53445BD6A573EFE942634901CCB7D666CFBE5FFC2317693D8A50580109EF3C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369897314174944","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725423714"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2b154.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518716667362554
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtJ+QZtsynzu6yiksJdXBuBuwBxWa0KNhfTX2QQRCYfYg:YuBqDPafaGnzp7gBzBxWdMfTnB0
MD5:	8AF261AEBF3C2B903739D699E77B4ED7
SHA1:	7A61418F34CF27946D5313245839551D41C63240
SHA-256:	5C2BE8CB0BD4610DCEFE88FC3EAD70CF880E6CB740B4A71B33EE595CFABFD0D6
SHA-512:	FEB22BC1FDA35E68408CF5E9ACE200F88E759726FBC81DDD477CF10CB9E97107CA53445BD6A573EFE942634901CCB7D666CFBE5FFC2317693D8A50580109EF3C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369897314174944","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725423714"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2ead3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518716667362554
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtJ+QZtsynzu6yiksJdXBuBuwBxWa0KNhfTX2QQRCYfYg:YuBqDPafaGnzp7gBzBxWdMfTnB0
MD5:	8AF261AEBF3C2B903739D699E77B4ED7
SHA1:	7A61418F34CF27946D5313245839551D41C63240
SHA-256:	5C2BE8CB0BD4610DCEFE88FC3EAD70CF880E6CB740B4A71B33EE595CFABFD0D6
SHA-512:	FEB22BC1FDA35E68408CF5E9ACE200F88E759726FBC81DDD477CF10CB9E97107CA53445BD6A573EFE942634901CCB7D666CFBE5FFC2317693D8A50580109EF3C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369897314174944","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725423714"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF33cdb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518716667362554
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtJ+QZtsynzu6yiksJdXBuBuwBxWa0KNhfTX2QQRCYfYg:YuBqDPafaGnzp7gBzBxWdMfTnB0
MD5:	8AF261AEBF3C2B903739D699E77B4ED7
SHA1:	7A61418F34CF27946D5313245839551D41C63240
SHA-256:	5C2BE8CB0BD4610DCEFE88FC3EAD70CF880E6CB740B4A71B33EE595CFABFD0D6
SHA-512:	FEB22BC1FDA35E68408CF5E9ACE200F88E759726FBC81DDD477CF10CB9E97107CA53445BD6A573EFE942634901CCB7D666CFBE5FFC2317693D8A50580109EF3C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369897314174944","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725423714"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF373ca.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518716667362554
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtJ+QZtsynzu6yiksJdXBuBuwBxWa0KNhfTX2QQRCYfYg:YuBqDPafaGnzp7gBzBxWdMfTnB0
MD5:	8AF261AEBF3C2B903739D699E77B4ED7
SHA1:	7A61418F34CF27946D5313245839551D41C63240
SHA-256:	5C2BE8CB0BD4610DCEFE88FC3EAD70CF880E6CB740B4A71B33EE595CFABFD0D6
SHA-512:	FEB22BC1FDA35E68408CF5E9ACE200F88E759726FBC81DDD477CF10CB9E97107CA53445BD6A573EFE942634901CCB7D666CFBE5FFC2317693D8A50580109EF3C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369897314174944","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725423714"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF39af9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518716667362554
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtJ+QZtsynzu6yiksJdXBuBuwBxWa0KNhfTX2QQRCYfYg:YuBqDPafaGnzp7gBzBxWdMfTnB0
MD5:	8AF261AEBF3C2B903739D699E77B4ED7
SHA1:	7A61418F34CF27946D5313245839551D41C63240
SHA-256:	5C2BE8CB0BD4610DCEFE88FC3EAD70CF880E6CB740B4A71B33EE595CFABFD0D6
SHA-512:	FEB22BC1FDA35E68408CF5E9ACE200F88E759726FBC81DDD477CF10CB9E97107CA53445BD6A573EFE942634901CCB7D666CFBE5FFC2317693D8A50580109EF3C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369897314174944","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725423714"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3faeb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.518716667362554
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtJ+QZtsynzu6yiksJdXBuBuwBxWa0KNhfTX2QQRCYfYg:YuBqDPafaGnzp7gBzBxWdMfTnB0
MD5:	8AF261AEBF3C2B903739D699E77B4ED7
SHA1:	7A61418F34CF27946D5313245839551D41C63240
SHA-256:	5C2BE8CB0BD4610DCEFE88FC3EAD70CF880E6CB740B4A71B33EE595CFABFD0D6
SHA-512:	FEB22BC1FDA35E68408CF5E9ACE200F88E759726FBC81DDD477CF10CB9E97107CA53445BD6A573EFE942634901CCB7D666CFBE5FFC2317693D8A50580109EF3C
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+676Lw=="},"profile":{"info_cache":{},"profile_counts_reported":"13369897314174944","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725423714"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl+l/:Ls3+l
MD5:	0ECCD51FC94059753B21D4A256DB8D6B
SHA1:	494628AA1C8A02293992654BE67BD1F0329DCBE7
SHA-256:	68C2919531D115032F0D11D830E824CAB74EF9A3F8AF53BC81E77FEB52BD02BC
SHA-512:	CD7FAFC2E5EB3DA80D77A48EA892706838353CF66EC53EB1971ECC600E8D8A9A5551DEEE181273D10ED357B3CC78ABCF9EF74BEDF8B0C8A7B07F9580D85113FA
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\bf8108e0-f797-4c76-89eb-f3c339192025.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.490325581269045
Encrypted:	false
SSDEEP:	96:0q8NkGS1faOK58rh/cI9URoDotohYBz+vOdi+VJkfcoSDS4S4SDSMlI4a:/8NBSsYeoDUNzi+bkf0
MD5:	76029FE836A11B7A58878D11BF74BEBC
SHA1:	A66A44F926C16A367444BB2B4225FFC7925892D5
SHA-256:	E352BB38BDC4D25247EAD1B832281AC796177352B08D9CBCD40FD6265023C0EB
SHA-512:	1DABCF7F0001C35F66CB49E11E41782908A70571D7EC475D79A828F65A7B4259ADC32839112FA599983355CB75872A7675BCD2730A436E480B3F52DFE639A929
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAABRB/Bpi7mS2GV6UiXIQRhnCZSoZM1SmiSgNIGA2eeamAAAAAAOgAAAAAIAACAAAADmie269wJe3vNKMlVEfXofyzOcRZ8QLhKh1manXW9aejAAAABIS6qr0Nev9G/n3BCs7bZwnHNi+r34DKSQiehf6R4vK5UOlCttCWxzXsXQxPLinwVAAAAAay6K69i3AL8RKc2k2nq2o0U6aSMJstDFCiOs+DSamcdxYiRgG1sTZB3T11l9RdRgYpMv92XGTEgbB4cF+

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ccd1f4c4-6b34-41fa-926c-11d43b55f3d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24327
Entropy (8bit):	6.054947662781958
Encrypted:	false
SSDEEP:	384:ctMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NGAVMku3oqdpVEw70Yf7Rp8mE2+I:8MGQ7FCYXGIgtDAWtJ4n2V5Kuw70K7pN
MD5:	0B8A91A307D62A4EF3A0DCF29BA3191A
SHA1:	7B98679D7B93290C7ACA24CC33658A3EBCCE3902
SHA-256:	239F6D234EA8B14DBC6B7AB23A1D7C77FA7EEDAA0EF1F301AC14C2BA61D04925
SHA-512:	03166825F5049A71E999C4764FA249D9E46A0C60D51227B5A6928B0C8E8D2E699366F909D18B3461C1C7FF742957389287B0B279464BD3E2DA3C66F66C7907B4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369897316688684","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\d21ba7f5-e2a5-48de-8134-3c7878d364ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	79116
Entropy (8bit):	6.070685276252586
Encrypted:	false
SSDEEP:	1536:8MGQ5XMBGfhUEuI6m5oDm1ZuDLH0R5MTuavaEvPDtTTkkw70Z7ZV:8MrJM8f+I6oWuZqHTTVvVvJTTt68tV
MD5:	E25DCCC0E88D4D62B3933864B1F45C07
SHA1:	93F71541C9FD711C5F1755FCA23899F1D2590B75
SHA-256:	E8B50917D301BD32D785644219A30F9B7BE04EA79E72E6FB4DF563883205246F
SHA-512:	EF66CCDC4A4167FF7BE5B4FBD3F3F3247A3520B2E34AF6B0AF0BD64B7663B8843A54F38D2AE645ED78ADC18E7B2839771E67F42AD1D5C0CBD87441768F9C6D9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369897316688684","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\d8621a8c-a260-49e9-9cd7-677e1e1fa8aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20991
Entropy (8bit):	6.062943875196295
Encrypted:	false
SSDEEP:	384:ctMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSAVGk+YYfHf7Rp8mE2+I:8MGQ7FCYXGIgtDAWtJ4nMVXjYf/7p/V
MD5:	B65684C80CABF6B1B48987439B7DB72D
SHA1:	9FF6D012C817CAFA006CF8D822655D77D058D018
SHA-256:	CE47B0BFE62C8307A3C4D88739EE1B4FD87DC86C1E498943280916F55D78E974
SHA-512:	C454F232DD1BD33B8F3442AE8C5F96E86CCC437A40F9CD3FE524A15937DD8E1E21397077F767213794AB2A728485506064F5F67EA215EC9F5BDC64BB243B4E9F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369897316688684","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\eca346c7-b057-40df-8c81-b38183b6aaab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20991
Entropy (8bit):	6.062932398553991
Encrypted:	false
SSDEEP:	384:ctMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSAVMk+YYfHf7Rp8mE2+I:8MGQ7FCYXGIgtDAWtJ4nMV5jYf/7p/V
MD5:	D0F977F1BAE405E908D9710DB4233159
SHA1:	449CA32FFCF5C7334F73FF702F2B1BFD00861849
SHA-256:	47553FCE1661588010C8D796D9D619FBB78DBD6659252EEFF218E4D9F87C6E8B
SHA-512:	C036A1FA808ECEBA447478D473AA27B46794857E319C30BA133FEDD9CE7ABF4081B9F3E9312D315A0E5329BB51513B1ACF2BE3FDCFDD91A0799B3ABB14482F58
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369897316688684","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411j

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\04d7f683-51f0-4367-a625-6ce55779403a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.798411842595493
Encrypted:	false
SSDEEP:	192:fsNwy1zhhzeiRUsnQXkfl6qRAq1k8SPxVLZ7VTiQ:fsNwK1h3hQUfl6q3QxVNZTiQ
MD5:	E52A4D2F1ACD9EE462903228AD66FBF4
SHA1:	78BF6B92D0701E3BEDE864A52512CB8E01B68F82
SHA-256:	0781F86B41B3C50253E538DA41F271506AC6A68BC3CA69F063C07CDA885A59E1
SHA-512:	89F218C16972471CB0CEB07598304C4DFB8CFE3051174D84AEEB7EC5927A3E8C83250D849D4D45C305214FF733668AF672CC27F154EC36B294F8A84BB22902E6
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\15a781ac-2efa-4b6e-b32c-71f7c03e0a58.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2ca7592d-7bb2-4fa8-9dcd-930b09e43c53.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22003
Entropy (8bit):	6.059086833367491
Encrypted:	false
SSDEEP:	384:qtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNwM1hMZmUfUEN555LI0G:OMGQ7FCYXGIgtDAWtJ4nI12mUfUUk
MD5:	474F474D3D6BB556134DE4182A8A7F20
SHA1:	0E29F9156DDE7AB5D73B9167C52BB09B34309D0F
SHA-256:	4621C349D3E6776D37F76CC3404651C96FD4EB94D8EC39792D13000F0505B216
SHA-512:	1E98B1ECDA5AC5D7CB7618CEDEEFD19EE7F57203B9032CB476275E00208821EFA903B2530DFF6069744B6E305DC239456323F2A66374D965398D3BD39168F719
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369897329511854","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2de36568-89e5-45db-a9f7-a16ab9d5d8f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.832039623744829
Encrypted:	false
SSDEEP:	192:fsNwy1zhhzeiRUs01MHQ5HZjwkfY96qRAq1k8SPxVLZ7VTiB:fsNwK1h3hEV5NbfY96q3QxVNZTiB
MD5:	6F979CF0543B0CCEF61DD5D8A15E2DD0
SHA1:	07BC280B00E689E371217A90B1F16E4D2852FF05
SHA-256:	06F64461DEEAC4D1CECA5836B81F674A6F0BF8148B863499B2525A78253B8C40
SHA-512:	74DB65A6CD662D37E43C9FA3EEA603D25E171EB7D8DB29680E9A3F400FAE098750903D9B83E15BFFA43B40F0E850F5873D512B0F9F49E7BE932EDD6D01422580
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\55b152a2-5afc-44ce-9cc8-720aea98f4b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59778
Entropy (8bit):	6.08002010667919
Encrypted:	false
SSDEEP:	1536:OMGQ5XMBGE1Daf8dP0SpXbrvu1jlOLICryVHzV:OMrJM8vkdP0SprrumIjVHzV
MD5:	67DA68CD3CB53EAFB05F2DB99F3A812C
SHA1:	F883680B756487DBED0B04DC9AF2DA0DFC27AAE2
SHA-256:	90B9C254F9E252804C688F958460B5DA33DF483C585F774FD7B63C2430D668E1
SHA-512:	F128A9F9D9415422F575E3A2F9C90CE957C4AAA6CAE28E0E5575332E6830B989ABB2773DDB06A0F8B5AF3BCF1ED371D6DB6AABF20B56E742898D5BF83AA0A133
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369897329511854","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6e7f0e31-bada-45ff-a34f-576f145d08b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.832180088347629
Encrypted:	false
SSDEEP:	192:fsNwy1zhhzeiRUs01MHQ5H6yCkfY96qRAq1k8SPxVLZ7VTiB:fsNwK1h3hEV5hBfY96q3QxVNZTiB
MD5:	4B7DDEAD009A06ED01281C8718C7BF83
SHA1:	7DF69875650F3A74843C957D04CD646A57427EE4
SHA-256:	C6056B4FD147EA60F6E33FAA1428A388865FA294B1B3CCEDDFC25FE70D9699BA
SHA-512:	BC2BBD3E87E2FDE4C70411383C7F136C7DC4011D823D2E0515F22BA63715C52692FF6F8A77090565D2107E1D2166C90A9FD048F0D6707FB4433E105012C63A08
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7d05e7f8-294c-437d-8698-b1a18cf726cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.831926354015972
Encrypted:	false
SSDEEP:	192:fsNwy1zhhzeiRUs01MHQ5HL1ykfY96qRAq1k8SPxVLZ7VTiB:fsNwK1h3hEV5JxfY96q3QxVNZTiB
MD5:	664A051433D18425F80354728D0E14C7
SHA1:	005294020E50188F0C6E7F3D1B52F25B5F59D86E
SHA-256:	A803F0028E87100EC3EBB1185D125F76FB8EB810650B41531CEC54637238E57D
SHA-512:	1345A12D7899F39BDDC76A213CDB01D93B459CA2A9ADF7B884DA8E247550791C3E286A375D02B8B23CFABD50796B1E84D1F68EDEEC49A3E6AD98631DFFDA7390
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\874735d9-3d45-48ab-85c1-f8bac1ce8921.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9432
Entropy (8bit):	5.832039623744829
Encrypted:	false
SSDEEP:	192:fsNwy1zhhzeiRUs01MHQ5HZjwkfY96qRAq1k8SPxVLZ7VTiB:fsNwK1h3hEV5NbfY96q3QxVNZTiB
MD5:	6F979CF0543B0CCEF61DD5D8A15E2DD0
SHA1:	07BC280B00E689E371217A90B1F16E4D2852FF05
SHA-256:	06F64461DEEAC4D1CECA5836B81F674A6F0BF8148B863499B2525A78253B8C40
SHA-512:	74DB65A6CD662D37E43C9FA3EEA603D25E171EB7D8DB29680E9A3F400FAE098750903D9B83E15BFFA43B40F0E850F5873D512B0F9F49E7BE932EDD6D01422580
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8fe478de-27b2-46c8-8320-8cf12f5d2df5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.831926354015972
Encrypted:	false
SSDEEP:	192:fsNwy1zhhzeiRUs01MHQ5HL1ykfY96qRAq1k8SPxVLZ7VTiB:fsNwK1h3hEV5JxfY96q3QxVNZTiB
MD5:	664A051433D18425F80354728D0E14C7
SHA1:	005294020E50188F0C6E7F3D1B52F25B5F59D86E
SHA-256:	A803F0028E87100EC3EBB1185D125F76FB8EB810650B41531CEC54637238E57D
SHA-512:	1345A12D7899F39BDDC76A213CDB01D93B459CA2A9ADF7B884DA8E247550791C3E286A375D02B8B23CFABD50796B1E84D1F68EDEEC49A3E6AD98631DFFDA7390
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9542e241-8fea-4e9d-8b80-25d373f515a0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59739
Entropy (8bit):	6.080037345579637
Encrypted:	false
SSDEEP:	1536:OMGQ5XMBGj1Daf8dP0SpXbrvu1jlOLICryVHzV:OMrJM8AkdP0SprrumIjVHzV
MD5:	33DBFCCCCA3E2B0B31B37E2AC9C95D00
SHA1:	29A2E7E4AC174AD11FD3B7E4DDFD056ABD6DC102
SHA-256:	C62E0C9E4391DE9B70CF56B09EB8A24C2FD34B8A821E4B485B569C3BF4E539A4
SHA-512:	D341F065FE9B86FB5A5DA25AFC608A906D0A9F76E686415163AB862ECD64342B31C788C67016BB1BBE7EB8F0EDE3759E0EE5BC2FBB6B6B89439A0E67D9ED2532
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369897329511854","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\419394a6-1633-4a8f-99cd-919044059ce5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D7E071-BF4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3104010584955495
Encrypted:	false
SSDEEP:	3072:H0p1LkjSdFf2aXNxwFiswBMeipkpkS7YXYBzNjO58cZtbTPKFNqKrd/Vf554Lalm:IsauD9S7YXTK2LaxraHG6
MD5:	5B9137FC6671E02E3F277C8B2C82AB63
SHA1:	875F966F4CF3A9672782E24BEF1452B3FEA4993C
SHA-256:	7610FE3753CD4102881EE14CC471AB48400CCE8BDF34E7B583C079C5DF148358
SHA-512:	855B1783CFF441C17FAA19D333782DF3E39AD667D2D07734CA34503F81CE2B15D72760293B621AA5ADF48F3220D94C47CC9E538D207158D500B560E557CD7105
Malicious:	false
Preview:	...@..@...@.....C.].....@...............H7...6..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".mklphy20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D7E079-27D8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03970282997881297
Encrypted:	false
SSDEEP:	192:6t0EbtmqvDtKX7gJEa3XxxTVwg7X0iV0DA5Lsh3VNg+O1gQtQ8rnq01n8y08TcmQ:40EtjeQtxkhllag78DX108T2RGOD
MD5:	5BE1B5C6DA7BF382256A76F4F6ED38DF
SHA1:	E5F8349B8FD074218EECB4B01B4513228B916456
SHA-256:	D9CF4266DF63BC2F5E45FB61F067E01EE1786ED5D1CCB85E3FD9A55BE397382E
SHA-512:	7B96B685E58F4B5D3CB3EF30D3659EB2924E1054B32BD5128188AE735994308AEE80C3D5C39A3E0F49BCFD96ECC727C3F03277AC81D3891C8594556CF819C9EE
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".mklphy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D7E081-5B4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03882639710432877
Encrypted:	false
SSDEEP:	192:uI0EbtmqvD3KX77JEa3Xxx7UpXxgg6zfh1YjNEIGtM1gQMypOxYq2n8y08Tcm2Rl:50EtGeZVQh0LWsgupvh08T2RGOD
MD5:	0CF18E5BA70DA35F189B706A2A430013
SHA1:	C9BAB0702C3A4F54AF7BF515FF6AEAB46D091A98
SHA-256:	31A357CC9948B24F9927E66F12B9FAF08B65408BF7DA03382B93489BF70A0471
SHA-512:	7EC4A214A006D4C0AAAFDDBD4F2D28EE33A3422356117B052AF54C524C42A7401DC3FE4220103F3980BA670C0408B8AFBB5EDC768DFEA5180AC00268BAC7FDFD
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".mklphy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D7E08E-2148.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03882928769840745
Encrypted:	false
SSDEEP:	192:uk0EbtmqvD3KX7CJEa3Xxx7UpXxgg6zfh1YjNEIGtM1gQMomO5pq2n8y08Tcm2Rl:V0EtXeZVQh0LWsgUm2h08T2RGOD
MD5:	04138A6FAB9C44F16B8513608F99C1CD
SHA1:	D7BA5D78EBADE4D180852984AC9A41881DFC8CD2
SHA-256:	3D2D2BE9728EAB73B3E2A8EDDA50DC92C56F021ECD4FB40FE086474EAA669D8C
SHA-512:	A5B0091174E4BEE8359B4B4E11DF2B9E4E16813CB73B8C628EC9630144EDE9961D52F03EAD80CFAFEACBDD512EAA611E0D479A81C4FC0E421C8D24AFD5588F57
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".mklphy20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3e539e1d-2db9-42dc-828f-713f1d570a52.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3fc600b5-5dae-4c57-8e8b-868cdb5caa37.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5580017878834305
Encrypted:	false
SSDEEP:	768:jnlCVfv7pLGLvOjWPScfGh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVp0hK4rwJJLpzm:jnlCVfpcvOjWPScfGhu1ja4WKpBtQ
MD5:	CCD99664EBAEAA1E845C01F504CD5B7D
SHA1:	B5578BB46FE9427233A0172CAC005F9ABC3C52E4
SHA-256:	0D9E5807290806D26161AF94975E0059C86B36505CB0190061CB28B95658D051
SHA-512:	C30248729EABB607063F917F4FBC5B9586EDF77AF4E2C0A73FAD963C5795E1A09000E1E809861C2C93E09A48AAFE016B03236137C07F74CB2D3097A9C0695457
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369897329338277","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369897329338277","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4fc0c16c-84b0-4d5b-867a-6b7e6de04c1b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.176430487316698
Encrypted:	false
SSDEEP:	192:sVFMJqdJYr6aH1VqsY/sYPpj+FVAimFBf:sVFMJqTNaHvqJpUVfu
MD5:	E4E21F24CE6DDBAE48B4C0D9DAA6865F
SHA1:	14818E0853B8E161773FF67D43098690E0018088
SHA-256:	8EC8876971DB13151CB746976381DE4083FF757319215221B869096EC8AA8C87
SHA-512:	805DB0752B52C43918A3605316F0B3014C15EB5F7A945A225FC9CA92B96AD21C8264AD8B3D1199C6EF1206E9C4C0E24AC69647ED4F3EF368CF7231BF2392D6D2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369897329496501","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8ea9badc-9813-43ab-a82c-27d4d0bd0907.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\96df294d-dc70-47aa-8a72-06345b557872.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9161
Entropy (8bit):	5.175670856390377
Encrypted:	false
SSDEEP:	192:sVFMJqdJYr6aH1VqsY/sYPpj+FVATmFBf:sVFMJqTNaHvqJpUVmu
MD5:	28E28625F4FB47BD5609FA031D165A9E
SHA1:	68DEDB34BE5DAC79E19FE2DDB0E88E8566598315
SHA-256:	74663BF3E7DE574311244C16EA1CC0425403A8979981D8D679919636493F4AE3
SHA-512:	F5825982130C496AC92D9BE4FF771CE691C2A9C3B08267802380B9CA717A5A9CA10D962BE3F956969E2D8525CDAA33A2AE801948C8C3AAA40472170C9555FE71
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369897329496501","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.320891243486844
Encrypted:	false
SSDEEP:	192:aAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:NOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	E420B9B99AF853660141E5CF886DA518
SHA1:	D8419A055C1F6A7F162B917DEA7C81C16752039D
SHA-256:	99D083216B01ED441C2D9182FC93DF7BC457EA3F6247035232B54F18BA6975C3
SHA-512:	6671A0753B8F77784C8D4257CBD7EF36670FB3D55FF8DDFB7EA0F2376F6EC3B9FC30E453F8F595625D7B5267A53918225CCFBD847AE2981C4CD777AFB85428B9
Malicious:	false
Preview:	...m.................DB_VERSION.1.0...................QUERY_TIMESTAMP:arbitration_priority_list4...13369897331615114.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.081880419467261
Encrypted:	false
SSDEEP:	6:PHEljhs1wkn23oH+Tcwt9Eh1ZB2KLllHEHX8yq2Pwkn23oH+Tcwt9Eh1tIFUv:PHEZhLfYeb9Eh1ZFLnHEHBvYfYeb9Ehp
MD5:	05E45CCF98B001AA2CE31203396E8858
SHA1:	7F3F2185D1F6CC3D77F8E90219390A6E67F2F7AB
SHA-256:	5FF9C660B8F1DA14CCD3DD2B6CD24FC8D87126F55E429C517759D9A62788F6BF
SHA-512:	33C4F1D0C364173734B21C335D82416EFFC2688453455F3CA61B9A526C08AB7E5AB3AC1499184FDE5307F84D01E80C30613A0714B754CA3A16DBD14520BFF5C6
Malicious:	false
Preview:	2024/09/04-00:22:10.673 2430 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/09/04-00:22:10.835 2430 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.448177365217996E-4
Encrypted:	false
SSDEEP:	3:LsNlFMKl/:Ls3FLl
MD5:	A8AEA3F61F1C9A08749C16DC25254178
SHA1:	0C9B465AB67F4F9A88C5DE4F9296D1A471F9A9E0
SHA-256:	539AD8AA7B2E7558259FA566BD1BAEAA884FF57E8FAC799A8976FF2A7B96D897
SHA-512:	C531E6AADAF8A78F6EBAE0DEA62052F85B3E6EDAA3FDC1055FAB3A04461935BAF4143AF30A7558F8C5BCB97D9D0201209F79E953D2F842333B8428B2BBF46ED1
Malicious:	false
Preview:	........................................;...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.178159337010509
Encrypted:	false
SSDEEP:	6:PHusR1wkn23oH+TcwtnG2tbB2KLllHCYWM+q2Pwkn23oH+TcwtnG2tMsIFUv:PHuTfYebn9VFLnHCYL+vYfYebn9GFUv
MD5:	88C96632922EE7F286AE0903072FBF2D
SHA1:	5C8D56536CEAC9A494AD017E90D6337204916C50
SHA-256:	98F1191CC3480BD4D840F0A0F90DD20A0A39576ACA823574B1C80E2796618AA9
SHA-512:	0F2391ABA82DB67E9E4A72EDF98A5E72BB9BF85F9929D4700770CEDBADA8F32B7246BCB348551D1DAFE6C833B87650F9084DF403C27745E6D79141E750B5D824
Malicious:	false
Preview:	2024/09/04-00:22:09.554 1f1c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/09/04-00:22:09.576 1f1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.1228370207051475
Encrypted:	false
SSDEEP:	6:PHRM1wkn23oH+Tcwt8aVdg2KLllHm2Vq2Pwkn23oH+Tcwt8aPrqIFUv:PHRrfYeb0LnHfVvYfYebL3FUv
MD5:	ADDAA5D341A35B2B3D126A791C1A5D44
SHA1:	84FD4223910C641864C10D521165805B5D188BEF
SHA-256:	A699F1E627B535A5F19E9D5BCD1AE693961B766499ABD600A3C505A0152CF366
SHA-512:	1AFD7C2CC496ECFB80DB08808FD283F47C4A04314CAF91E6EC2661ACF3484C3B7F8FB26BBB91D80C5A11E2882998E562DDC709A0D5EAC08C4F11DF937757EED2
Malicious:	false
Preview:	2024/09/04-00:22:09.413 1f14 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/09/04-00:22:09.705 1f14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.09548716559276
Encrypted:	false
SSDEEP:	6:PHk8M1wkn23oH+Tcwt86FB2KLllHIFUI0Vq2Pwkn23oH+Tcwt865IFUv:PHk8rfYeb/FFLnHI2VvYfYeb/WFUv
MD5:	B1672A1CA03246A990BC12F15CED4A9B
SHA1:	1419AC08457318F3E189957E04FEF7D30E9CAB98
SHA-256:	BBC617AEAAE195E4F7987D4C07AEEEFCFFD96831189506E25630AE0F2ADFF3AD
SHA-512:	2D19EF941D039EA21F3D56D1E44214F7C5AE470241613920E25DCE41F6AFE47B2628FFFEC910DD5D2D22AC34FE51ABBB773E6FA67971DA5DCB8BE0CFA6065FA2
Malicious:	false
Preview:	2024/09/04-00:22:09.707 1f14 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/09/04-00:22:09.721 1f14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.158303057175481
Encrypted:	false
SSDEEP:	6:PHdVq2Pwkn23oH+Tcwt8NIFUt82H2uDU0gZmw+2HI/IkwOwkn23oH+Tcwt8+eLJ:PHdVvYfYebpFUt82Hvg/+2HI/I5JfYey
MD5:	DD9799D4A1921262558871095AE7D7F3
SHA1:	51D87427C355EDF47C6FD374B8AFE45182D3E5F6
SHA-256:	FDFB197DF97D5D769DB86F626D7F2BF17A53A9CA110520057CF065DBFB9CF711
SHA-512:	275C228A9A59304F7087A1862CAC3A2402093C6C94FD7DE35F382B29CDB1F3CC38AC4C57FEAD354C39399EF73F39630198466C4806381D61347A5575CE325C55
Malicious:	false
Preview:	2024/09/04-00:22:09.758 1f14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/04-00:22:09.763 1f14 Recovering log #3.2024/09/04-00:22:09.764 1f14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.158303057175481
Encrypted:	false
SSDEEP:	6:PHdVq2Pwkn23oH+Tcwt8NIFUt82H2uDU0gZmw+2HI/IkwOwkn23oH+Tcwt8+eLJ:PHdVvYfYebpFUt82Hvg/+2HI/I5JfYey
MD5:	DD9799D4A1921262558871095AE7D7F3
SHA1:	51D87427C355EDF47C6FD374B8AFE45182D3E5F6
SHA-256:	FDFB197DF97D5D769DB86F626D7F2BF17A53A9CA110520057CF065DBFB9CF711
SHA-512:	275C228A9A59304F7087A1862CAC3A2402093C6C94FD7DE35F382B29CDB1F3CC38AC4C57FEAD354C39399EF73F39630198466C4806381D61347A5575CE325C55
Malicious:	false
Preview:	2024/09/04-00:22:09.758 1f14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/04-00:22:09.763 1f14 Recovering log #3.2024/09/04-00:22:09.764 1f14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.32835775817102963
Encrypted:	false
SSDEEP:	6:pFA/J3+t76Y4QZZofU99pO0BYsTqR4EZY4QZvGi:UhHQws9LdPmBQZGi
MD5:	1944CD28C2E20A8876E46AD1CED3A5C9
SHA1:	1A009CC1DFC053764C5D6BB9082511FFCE83F602
SHA-256:	665AB46AB9ED8D7300A2C716459D54C55D1C5CEC325E10EB212A962E6EDFC954
SHA-512:	DC08F6020F52ADBB6543F2D43793C0EDCF61927ABE32DED64BE51E2742428DF13F201952FB02854376385492F93DD8BB2AF6C910A26DD07FA52E9C1B577C0E36
Malicious:	false
Preview:	............X.%^...'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.182644326874181
Encrypted:	false
SSDEEP:	12:PHEs9IvYfYeb8rcHEZrELFUt82HEs9Z/+2HED5JfYeb8rcHEZrEZSJ:10YfYeb8nZrExg8OKJfYeb8nZrEZe
MD5:	DCA57FE8A5CBC7F8207D18D7D7E28FFC
SHA1:	0F0A528E6BAFB8FE8D6B7D509CC16B16326C19AC
SHA-256:	9499EE543AAB4702E07FE1FB76C77EDDCBE4F20C4CEA570787D0465EE32B129F
SHA-512:	A069875E9F3834D28FA3B8874BEED57C79646B489DF730E316F58F871CD68E27AFC29500D54B1C266356FE1B203F94FFB1983457E14000FCFB9DD556B292AAFE
Malicious:	false
Preview:	2024/09/04-00:22:10.423 1eb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/04-00:22:10.423 1eb4 Recovering log #3.2024/09/04-00:22:10.424 1eb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.182644326874181
Encrypted:	false
SSDEEP:	12:PHEs9IvYfYeb8rcHEZrELFUt82HEs9Z/+2HED5JfYeb8rcHEZrEZSJ:10YfYeb8nZrExg8OKJfYeb8nZrEZe
MD5:	DCA57FE8A5CBC7F8207D18D7D7E28FFC
SHA1:	0F0A528E6BAFB8FE8D6B7D509CC16B16326C19AC
SHA-256:	9499EE543AAB4702E07FE1FB76C77EDDCBE4F20C4CEA570787D0465EE32B129F
SHA-512:	A069875E9F3834D28FA3B8874BEED57C79646B489DF730E316F58F871CD68E27AFC29500D54B1C266356FE1B203F94FFB1983457E14000FCFB9DD556B292AAFE
Malicious:	false
Preview:	2024/09/04-00:22:10.423 1eb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/09/04-00:22:10.423 1eb4 Recovering log #3.2024/09/04-00:22:10.424 1eb4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.058372305306038
Encrypted:	false
SSDEEP:	6:PHEuN1WM+q2Pwkn23oH+Tcwt8a2jMGIFUt82HEdBfF3j1Zmw+2HEjoE1WMVkwOwg:PHEuN1L+vYfYeb8EFUt82HE5J/+2HEdY
MD5:	1ACD058E37C87ED1140B3E36D9165C1F
SHA1:	1DECD2B26093454576C532FBEEAE7F6302A3A0BF
SHA-256:	50CA66AC0558E373D090E9352F1E19197F01B7D67B45D525FE3519F0A64E75DC
SHA-512:	6DBB86223F428E70927C6909CDFF94C901BE2F2430824B264D48C95F3FAFE90EEB1C691D5F3D841327138D47A20037DAD498EA8815D0D65B475D0DD57948E347
Malicious:	false
Preview:	2024/09/04-00:22:10.229 241c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/04-00:22:10.231 241c Recovering log #3.2024/09/04-00:22:10.244 241c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.058372305306038
Encrypted:	false
SSDEEP:	6:PHEuN1WM+q2Pwkn23oH+Tcwt8a2jMGIFUt82HEdBfF3j1Zmw+2HEjoE1WMVkwOwg:PHEuN1L+vYfYeb8EFUt82HE5J/+2HEdY
MD5:	1ACD058E37C87ED1140B3E36D9165C1F
SHA1:	1DECD2B26093454576C532FBEEAE7F6302A3A0BF
SHA-256:	50CA66AC0558E373D090E9352F1E19197F01B7D67B45D525FE3519F0A64E75DC
SHA-512:	6DBB86223F428E70927C6909CDFF94C901BE2F2430824B264D48C95F3FAFE90EEB1C691D5F3D841327138D47A20037DAD498EA8815D0D65B475D0DD57948E347
Malicious:	false
Preview:	2024/09/04-00:22:10.229 241c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/09/04-00:22:10.231 241c Recovering log #3.2024/09/04-00:22:10.244 241c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1548633d-ef16-48ff-b3b8-645fb3ecd6af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3105f825-f16c-4982-b7a7-3b037ee59913.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\74dec96f-77a0-4c17-88cc-24445b14bed1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8bff7942-f985-4d48-b66c-81a7ca75c809.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.299476984804796
Encrypted:	false
SSDEEP:	24:YXs3CZVMdBs/yZFRudFGcsJXZFGJ/dbG7nby:YXsG8sOfcdsJJgzbZ
MD5:	373D3FEAB42D17390D16CD5A756F77D7
SHA1:	A4A34DE99543C4CDBF1CC6199EF4EC5F96A46F69
SHA-256:	9D5822E369FB15E4356AC9F1239CC234DE3BA4E05F3E4DF2A32012CE3FBCD0DA
SHA-512:	129D00C9DC3A74800BA7BD2BC77581E14C29668E66D52141B05F5CE23DE7E915188894D4D2D76767AC9C4383B2B8D83FE205513C36071581C25F9661F203F3A9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372489331513010","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372489332621646","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372489335647253","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2eecb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3dc48.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2c828.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2d6ed.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2eecb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c2d08127-5a75-4184-84aa-13a60a4d9cc5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ca78f6fb-7323-417b-a38e-4f70c7a2498f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d9bc1cfb-e865-4854-8548-46166a43bada.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.065154310612773
Encrypted:	false
SSDEEP:	96:sVFqlHJ1Vb9B6NjJYXbzjZwY/sY5Th6Cp9/x+6M8muecmAeCve4zvrm2X6gE5Aty:sVFMJqdJYrqY/sYPpj+FVATmFBf
MD5:	0DAD1BBC55D0EFCE245F9D6200D17695
SHA1:	AF5A391A372E769334BE5225F67ED6028CF9596C
SHA-256:	56C09C602F1AAD6FF93FB86CC8E22F29875E20F41604453ED4A90FB300429012
SHA-512:	53AE0FA6121B22D84C345C67D022225E9CD5E5E2487EEB6F09C128E6850F086D0F5E5152B7513D97C562CB3AE9A5EB207C739EEBE00861E059676B80C1B33547
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369897329496501","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF31aec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.065154310612773
Encrypted:	false
SSDEEP:	96:sVFqlHJ1Vb9B6NjJYXbzjZwY/sY5Th6Cp9/x+6M8muecmAeCve4zvrm2X6gE5Aty:sVFMJqdJYrqY/sYPpj+FVATmFBf
MD5:	0DAD1BBC55D0EFCE245F9D6200D17695
SHA1:	AF5A391A372E769334BE5225F67ED6028CF9596C
SHA-256:	56C09C602F1AAD6FF93FB86CC8E22F29875E20F41604453ED4A90FB300429012
SHA-512:	53AE0FA6121B22D84C345C67D022225E9CD5E5E2487EEB6F09C128E6850F086D0F5E5152B7513D97C562CB3AE9A5EB207C739EEBE00861E059676B80C1B33547
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369897329496501","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF35e7c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.065154310612773
Encrypted:	false
SSDEEP:	96:sVFqlHJ1Vb9B6NjJYXbzjZwY/sY5Th6Cp9/x+6M8muecmAeCve4zvrm2X6gE5Aty:sVFMJqdJYrqY/sYPpj+FVATmFBf
MD5:	0DAD1BBC55D0EFCE245F9D6200D17695
SHA1:	AF5A391A372E769334BE5225F67ED6028CF9596C
SHA-256:	56C09C602F1AAD6FF93FB86CC8E22F29875E20F41604453ED4A90FB300429012
SHA-512:	53AE0FA6121B22D84C345C67D022225E9CD5E5E2487EEB6F09C128E6850F086D0F5E5152B7513D97C562CB3AE9A5EB207C739EEBE00861E059676B80C1B33547
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369897329496501","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d3bc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.065154310612773
Encrypted:	false
SSDEEP:	96:sVFqlHJ1Vb9B6NjJYXbzjZwY/sY5Th6Cp9/x+6M8muecmAeCve4zvrm2X6gE5Aty:sVFMJqdJYrqY/sYPpj+FVATmFBf
MD5:	0DAD1BBC55D0EFCE245F9D6200D17695
SHA1:	AF5A391A372E769334BE5225F67ED6028CF9596C
SHA-256:	56C09C602F1AAD6FF93FB86CC8E22F29875E20F41604453ED4A90FB300429012
SHA-512:	53AE0FA6121B22D84C345C67D022225E9CD5E5E2487EEB6F09C128E6850F086D0F5E5152B7513D97C562CB3AE9A5EB207C739EEBE00861E059676B80C1B33547
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369897329496501","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5580017878834305
Encrypted:	false
SSDEEP:	768:jnlCVfv7pLGLvOjWPScfGh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVp0hK4rwJJLpzm:jnlCVfpcvOjWPScfGhu1ja4WKpBtQ
MD5:	CCD99664EBAEAA1E845C01F504CD5B7D
SHA1:	B5578BB46FE9427233A0172CAC005F9ABC3C52E4
SHA-256:	0D9E5807290806D26161AF94975E0059C86B36505CB0190061CB28B95658D051
SHA-512:	C30248729EABB607063F917F4FBC5B9586EDF77AF4E2C0A73FAD963C5795E1A09000E1E809861C2C93E09A48AAFE016B03236137C07F74CB2D3097A9C0695457
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369897329338277","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369897329338277","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF31435.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5580017878834305
Encrypted:	false
SSDEEP:	768:jnlCVfv7pLGLvOjWPScfGh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVp0hK4rwJJLpzm:jnlCVfpcvOjWPScfGhu1ja4WKpBtQ
MD5:	CCD99664EBAEAA1E845C01F504CD5B7D
SHA1:	B5578BB46FE9427233A0172CAC005F9ABC3C52E4
SHA-256:	0D9E5807290806D26161AF94975E0059C86B36505CB0190061CB28B95658D051
SHA-512:	C30248729EABB607063F917F4FBC5B9586EDF77AF4E2C0A73FAD963C5795E1A09000E1E809861C2C93E09A48AAFE016B03236137C07F74CB2D3097A9C0695457
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369897329338277","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369897329338277","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.09759503107147
Encrypted:	false
SSDEEP:	6:PHmWmjF1WM+q2Pwkn23oH+TcwtrQMxIFUt82HmWihj1Zmw+2HmWdlN1WMVkwOwkE:PHhmjF1L+vYfYebCFUt82HhihJ/+2Hh9
MD5:	38A9C6DF416153573933B0152FFA3407
SHA1:	D6C005CCD2A0C0B24DA5C782268635AAC8C8663A
SHA-256:	C3517701C93DDE0D28ACFE4C81AD06E7F6A916097AA6F02D42CA6F2FB121971B
SHA-512:	9910752254902EF60ED495A4BEDA2047EA0759A4C875E83D473B6EA446F68F2B7354B499A3A777368C3D5AB352BF3CEDFFA0A7C8543551F0689B41FAE4983FE5
Malicious:	false
Preview:	2024/09/04-00:22:25.370 241c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/04-00:22:25.374 241c Recovering log #3.2024/09/04-00:22:25.379 241c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.09759503107147
Encrypted:	false
SSDEEP:	6:PHmWmjF1WM+q2Pwkn23oH+TcwtrQMxIFUt82HmWihj1Zmw+2HmWdlN1WMVkwOwkE:PHhmjF1L+vYfYebCFUt82HhihJ/+2Hh9
MD5:	38A9C6DF416153573933B0152FFA3407
SHA1:	D6C005CCD2A0C0B24DA5C782268635AAC8C8663A
SHA-256:	C3517701C93DDE0D28ACFE4C81AD06E7F6A916097AA6F02D42CA6F2FB121971B
SHA-512:	9910752254902EF60ED495A4BEDA2047EA0759A4C875E83D473B6EA446F68F2B7354B499A3A777368C3D5AB352BF3CEDFFA0A7C8543551F0689B41FAE4983FE5
Malicious:	false
Preview:	2024/09/04-00:22:25.370 241c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/04-00:22:25.374 241c Recovering log #3.2024/09/04-00:22:25.379 241c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0606532800142965
Encrypted:	false
SSDEEP:	6:PHuVi+q2Pwkn23oH+Tcwt7Uh2ghZIFUt82HDmWZmw+2H/aIVkwOwkn23oH+Tcwts:PH9+vYfYebIhHh2FUt82HDZ/+2H/aIVw
MD5:	4EC7206731E697CB3F140B47A080F175
SHA1:	C439A97EF91A2F72AC4533882E92AD80FB682EC7
SHA-256:	32FE77510F3BF9D4D2290C95848CCDC6F36D8320D088CA668C3DE7D8D89BD91F
SHA-512:	A576AD9987C2F06049CCD59AD5472953EE188F389781007769B1B6E3663684DF3B65C1B0485C986BB6A3D2EA81F416D6DB7B19B50374A5623EACC4A8FF336C81
Malicious:	false
Preview:	2024/09/04-00:22:09.430 1f0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/04-00:22:09.434 1f0c Recovering log #3.2024/09/04-00:22:09.452 1f0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0606532800142965
Encrypted:	false
SSDEEP:	6:PHuVi+q2Pwkn23oH+Tcwt7Uh2ghZIFUt82HDmWZmw+2H/aIVkwOwkn23oH+Tcwts:PH9+vYfYebIhHh2FUt82HDZ/+2H/aIVw
MD5:	4EC7206731E697CB3F140B47A080F175
SHA1:	C439A97EF91A2F72AC4533882E92AD80FB682EC7
SHA-256:	32FE77510F3BF9D4D2290C95848CCDC6F36D8320D088CA668C3DE7D8D89BD91F
SHA-512:	A576AD9987C2F06049CCD59AD5472953EE188F389781007769B1B6E3663684DF3B65C1B0485C986BB6A3D2EA81F416D6DB7B19B50374A5623EACC4A8FF336C81
Malicious:	false
Preview:	2024/09/04-00:22:09.430 1f0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/04-00:22:09.434 1f0c Recovering log #3.2024/09/04-00:22:09.452 1f0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulAau:LsS
MD5:	13EB42337D16835D4CAD02451A3B0E0C
SHA1:	CEC0A058EBCB87B2E603CAB58F524E65D619C134
SHA-256:	0A4759FC38F906FE71DD84E6F303CA125416D055D5CD71A98882F17B4F5C89C5
SHA-512:	81BFCE015E9244033F9F86D854D81EC294EC00C109BA30EC2117344861CC38CC9D99D2F9EC453336FBD3305939D265577D94416E79FF9CE92A846D4102583A3E
Malicious:	false
Preview:	.........................................RX.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl/Rll:Ls3
MD5:	9960756B1CA26D7D2BAB91165BB764FF
SHA1:	1A092125E85EC99D6044F79F748612C79CA234D2
SHA-256:	CA11673A79C713696129C5C6B71C4A86DA5687040442C03290383CD5D76310AC
SHA-512:	6F3C5BE21D2D3ADC06931DB58C070DE2E5E04827A163212955CF8DB68827DEF0C7EADC4FE8F9E4959F2CFE787A9A67145D36ED4E206EA282BBF767B8290A861A
Malicious:	false
Preview:	.........................................H..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.171042797340649
Encrypted:	false
SSDEEP:	12:PHEK0VvYfYebvqBQFUt82HEpg/+2HEdRR0I5JfYebvqBvJ:A5YfYebvZg8TNRiSJfYebvk
MD5:	3FFDCF40BF02D74C88BB0BCBD4B2851F
SHA1:	0456D43CD9F0876EF03A2613BB1672F729387BE7
SHA-256:	EDA64D5212F66AD966749A15E58FBC5F887D7B02E0D019B2FD255ECDC2AE77EC
SHA-512:	E03FF8D9A375191B97DE52FD217C8984CE5CABB10CCDBB254498C1DFE31420159A26D5EB6265324A08CC5D506066C3156A9BF753C13B977A068D2C8DEE6E3393
Malicious:	false
Preview:	2024/09/04-00:22:10.249 2444 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/04-00:22:10.250 2444 Recovering log #3.2024/09/04-00:22:10.253 2444 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.171042797340649
Encrypted:	false
SSDEEP:	12:PHEK0VvYfYebvqBQFUt82HEpg/+2HEdRR0I5JfYebvqBvJ:A5YfYebvZg8TNRiSJfYebvk
MD5:	3FFDCF40BF02D74C88BB0BCBD4B2851F
SHA1:	0456D43CD9F0876EF03A2613BB1672F729387BE7
SHA-256:	EDA64D5212F66AD966749A15E58FBC5F887D7B02E0D019B2FD255ECDC2AE77EC
SHA-512:	E03FF8D9A375191B97DE52FD217C8984CE5CABB10CCDBB254498C1DFE31420159A26D5EB6265324A08CC5D506066C3156A9BF753C13B977A068D2C8DEE6E3393
Malicious:	false
Preview:	2024/09/04-00:22:10.249 2444 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/09/04-00:22:10.250 2444 Recovering log #3.2024/09/04-00:22:10.253 2444 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\15e8dc1b-32b8-4393-a609-050fd7cb2e02.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2156c2ec-1201-408c-a3b5-0c119196d31a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3a29bf77-1045-4653-af57-abc025105039.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF3ed01.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2d6fd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bb0612f1-d021-49e4-98a2-f296476a9527.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.218703093844076
Encrypted:	false
SSDEEP:	12:PHhFXhSVvYfYebvqBZFUt82Hh5n0g/+2HhDI5JfYebvqBaJ:5u5YfYebvyg8w506DSJfYebvL
MD5:	DE933A115C66B69F98712838F52B808E
SHA1:	4423A0A67DEFEAA40D68A6D4F0752FFF1E65DEA8
SHA-256:	ACE5B053AEF75A33105D93FA2B0B594F342211AE987933AA430525D0D2E2A4E9
SHA-512:	F4CCB8464293253E3914C0393058853D298FA81CA7696A40A0E62970B43BE699924FA4DE707AA6421D5EA416C7FF3AF6C6B70BDFE4694E49D32DD89FBA6DC045
Malicious:	false
Preview:	2024/09/04-00:22:25.371 2444 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/04-00:22:25.375 2444 Recovering log #3.2024/09/04-00:22:25.381 2444 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.218703093844076
Encrypted:	false
SSDEEP:	12:PHhFXhSVvYfYebvqBZFUt82Hh5n0g/+2HhDI5JfYebvqBaJ:5u5YfYebvyg8w506DSJfYebvL
MD5:	DE933A115C66B69F98712838F52B808E
SHA1:	4423A0A67DEFEAA40D68A6D4F0752FFF1E65DEA8
SHA-256:	ACE5B053AEF75A33105D93FA2B0B594F342211AE987933AA430525D0D2E2A4E9
SHA-512:	F4CCB8464293253E3914C0393058853D298FA81CA7696A40A0E62970B43BE699924FA4DE707AA6421D5EA416C7FF3AF6C6B70BDFE4694E49D32DD89FBA6DC045
Malicious:	false
Preview:	2024/09/04-00:22:25.371 2444 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/09/04-00:22:25.375 2444 Recovering log #3.2024/09/04-00:22:25.381 2444 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.112329138936928
Encrypted:	false
SSDEEP:	6:PHoSVq2Pwkn23oH+TcwtpIFUt82HQgZmw+2HQIkwOwkn23oH+Tcwta/WLJ:PHLVvYfYebmFUt82HQg/+2HQI5JfYeb7
MD5:	161613E4140F7BDCAD925B320473678C
SHA1:	06C1CDFBEFFC55715F3822AC4AE4212EFF4BD158
SHA-256:	9DF3DBA8901B4603D32E10386BC655E1F1FBC306F7A6E65B429D4AD73221F304
SHA-512:	E94D9586488C2239E37D788AB97B6BDDBC173F8B0B0AE63466BD7877B71C893E7A885B4036674093DD202D7E7F155AF6ED25703CED01CA4157E9F60DF2FBB01E
Malicious:	false
Preview:	2024/09/04-00:22:09.411 1f14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/04-00:22:09.412 1f14 Recovering log #3.2024/09/04-00:22:09.412 1f14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.112329138936928
Encrypted:	false
SSDEEP:	6:PHoSVq2Pwkn23oH+TcwtpIFUt82HQgZmw+2HQIkwOwkn23oH+Tcwta/WLJ:PHLVvYfYebmFUt82HQg/+2HQI5JfYeb7
MD5:	161613E4140F7BDCAD925B320473678C
SHA1:	06C1CDFBEFFC55715F3822AC4AE4212EFF4BD158
SHA-256:	9DF3DBA8901B4603D32E10386BC655E1F1FBC306F7A6E65B429D4AD73221F304
SHA-512:	E94D9586488C2239E37D788AB97B6BDDBC173F8B0B0AE63466BD7877B71C893E7A885B4036674093DD202D7E7F155AF6ED25703CED01CA4157E9F60DF2FBB01E
Malicious:	false
Preview:	2024/09/04-00:22:09.411 1f14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/04-00:22:09.412 1f14 Recovering log #3.2024/09/04-00:22:09.412 1f14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:Cl6//l1lhtl0n:CS3kn
MD5:	530E58985B48EE2394D9A830CA052846
SHA1:	FE486CEC740F3C069540A4F0DCB9833A054D06D1
SHA-256:	EF39E7AF15210FA9276D263B3424FBD0945DD53CC97419CDE977AD7D8952F126
SHA-512:	273D1BD90447EF66C4DC4DBF9A474A8E93811CF62045FD7B5474B2BFCF9E53F54E9D1686E086DCB1B9F840796EF4367E13BBE5D3E35CE3A426C601756DCF3263
Malicious:	false
Preview:	............f..B...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a4f8152c-334d-42c1-b243-f321a6834952.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.065154310612773
Encrypted:	false
SSDEEP:	96:sVFqlHJ1Vb9B6NjJYXbzjZwY/sY5Th6Cp9/x+6M8muecmAeCve4zvrm2X6gE5Aty:sVFMJqdJYrqY/sYPpj+FVATmFBf
MD5:	0DAD1BBC55D0EFCE245F9D6200D17695
SHA1:	AF5A391A372E769334BE5225F67ED6028CF9596C
SHA-256:	56C09C602F1AAD6FF93FB86CC8E22F29875E20F41604453ED4A90FB300429012
SHA-512:	53AE0FA6121B22D84C345C67D022225E9CD5E5E2487EEB6F09C128E6850F086D0F5E5152B7513D97C562CB3AE9A5EB207C739EEBE00861E059676B80C1B33547
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369897329496501","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b776914d-6a48-4145-9579-8262565335b2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30244
Entropy (8bit):	5.566338103196183
Encrypted:	false
SSDEEP:	768:jnlCVfv7pLGLvOjWPScf1h8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwFa0hK4rwJ8LZ:jnlCVfpcvOjWPScf1hu1jahFaWKp8th
MD5:	B339343D6B90823A921B3B54200170AA
SHA1:	B9975531D7751C73CA6511B4531FB60D8E96C8C2
SHA-256:	A189B847DB6FF1DAAF44D5D2E9B275FB7F20666F515D14D0ADF3E66C3BF4CD98
SHA-512:	4080D7D00B8B8A9D669AE095C1A7E526DC0A59A19CE94A55DF5CD2C0BF051733F12211A8FBB56E10B14CC4D9E1A970A228445AA16A715B9133CADA981E3AC2CA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369897329338277","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369897329338277","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ce8e6aaa-074d-4d0b-8cab-2c9a4cf470b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9333
Entropy (8bit):	5.175279337557859
Encrypted:	false
SSDEEP:	192:sVFMJqdJYr6aH1VqsY/sYPpj+FVAbmFBf:sVFMJqTNaHvqJpUViu
MD5:	035E4929C50D6BE5F71B52BC99172E77
SHA1:	C2D356CDD145EC444FC3C807D51DAE67B5CBDD30
SHA-256:	3D507F4D9480A599003D3440A0A9D7EA94E7B90D8D67FCE9943184A552984AE6
SHA-512:	9073C5C33D3E4A6D195CD3CC2CA677C0259A614D42932280AF383F51A83B61907833378F69516CEC4E3844ABDF0A5D6F3AD993DB125BC07E89343A4519EFF249
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369897329496501","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.29193989140738
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQm/VlFl3seGKT9rcQ6xhCEOtlTxotl:/XntM+VlFl3sedhOvOu
MD5:	71AB8F273DFF4E2016B28E7C7B685D13
SHA1:	E37327AB9ECCD4CDC2D8BBBA314162DD557F1801
SHA-256:	FF46D941B465B219816C302E0650D3D0046A0508924715586CAF9D93748E20A7
SHA-512:	3009DBB5E00606C0F500FEE072AF0FB03CD6E7F30BF0BAE0B05D15C7919735EF952510C54A4303A63BC666B242A592E84392BDB0F64196134E0412B37208C60A
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.`-.0................39_config..........6.....n ...1u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.154271291271945
Encrypted:	false
SSDEEP:	6:PHqlERM1wkn23oH+Tcwtfrl2KLllHoofSVq2Pwkn23oH+TcwtfrK+IFUv:PH1RrfYeb1LnHoo6VvYfYeb23FUv
MD5:	689F3A2C3A1775B5CB5979131D11E0CA
SHA1:	50D22DC6257A64B017CF00B8658D6FA82F03540D
SHA-256:	63A1B5BDB338930E428979B8253A3F2A8C6C9495BD3A5386B7D0E92A7A9DA62A
SHA-512:	494EC9F337F63F830CC429B6DECA409B3FC179B924E999F3DABE4818F1AA0A03B31950F3739E36DADBE510278AE078DC6C267E4FC7DF148A4B5989B38C9ED765
Malicious:	false
Preview:	2024/09/04-00:22:09.649 1f04 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/09/04-00:22:09.664 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	646
Entropy (8bit):	3.9151458452032917
Encrypted:	false
SSDEEP:	12:G0nYUtTNVdZ5zD/7bEXZmh/U/9Y+chR6XuC7u9:G0nYUtP35zDjomhCe+cieV9
MD5:	8F687093ED0B4DD8967C96B467829126
SHA1:	2C8AB46BCA50CD972768ED8957155DB74D37CCFD
SHA-256:	2112014695D441BC9920C060D7F564505D57BB78AC2F3504956992A06EFE03F2
SHA-512:	DA9EDA26218095E5FA0AFD608890A10F2CB3C4F738719658E925A097F6FAC3C61796DA1733C8DA965DAFEA76D0BDC0375D67575218AC153BD4F9850CE5D27DF6
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....'...................20_.......T=.................19_.....*...................18_........a.................37_......x...................38_........i.................39_.........................20_........].................20_.....{a...................19_.....f.F..................18_.......\|.................37_.......&B.................38_........D.................39_........................21_.....dz.\|.................9_..........................21_.....JJ...................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.144012913579309
Encrypted:	false
SSDEEP:	6:PH7xERM1wkn23oH+Tcwtfrzs52KLllHhD2Vq2Pwkn23oH+TcwtfrzAdIFUv:PH7CRrfYebs9LnHV2VvYfYeb9FUv
MD5:	28906FA2849668020BBAFDABD55EC044
SHA1:	173A66D5D32C92C5742DF6F7DDA5C78D176776B9
SHA-256:	C07409BF2C171FEA45904B8F448BC6BD07852AA1E4DB57EE23716BC80895B582
SHA-512:	43F7D513B0FD531B5CE6DAC43FAE18B4523C23F25D6F82B5B07820D8C1F3ECAC2673146D4D8D19A8E44E8290316B43B7ED99AFE339C8FEF57E5EC4602C9682F5
Malicious:	false
Preview:	2024/09/04-00:22:09.497 1f04 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/09/04-00:22:09.567 1f04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlXu:Ls3
MD5:	038B873394AEE3105F5BAC8452738AD9
SHA1:	ED3D33F7945E2974873E6CC1AAD5C433BDC75B87
SHA-256:	2D500052CFA5D0A374160C9A42C1415D83E99469BD8F05D682E3B4340440C4E7
SHA-512:	89C377E55256EFF169016DC0992C2FC17DFBC64C1FE5C9B328BE158D4D85836B8CFA1D34718A092956804B364C082E72CF8C32D11A4DAB49C45202E7A1F134B6
Malicious:	false
Preview:	.........................................c..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlwL:Ls3
MD5:	5493C5428C8FDAAF44676A576981BF12
SHA1:	B7B843E8931EDD45791E8DAABE99689ED6B1AE43
SHA-256:	A068C466837B87A017BBCE264F945219FACB57F5812FF1FB15E0952C39913A67
SHA-512:	59BB57A050DAB9D3E23132BC537A14D37BCEC8C43DF38664906E99989AF20FD2287BDA26F20F1A3029399F9D474F07200964FFEFEFAD47507DD55AF61D213BEF
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2c28b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2c2aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e257.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e267.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e286.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30178.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30188.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3348e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3349e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ac5e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d37e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF422f5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791784451580896
Encrypted:	false
SSDEEP:	192:aky1zhhIeiRUshW6qRAq1k8SPxVLZ7VTiq:akK1hyDW6q3QxVNZTiq
MD5:	27AAB0A59AF64A2F2363F26BD04FF254
SHA1:	9F12F241D3E225913C7FC94F7C974CDC01AF5FDA
SHA-256:	569C53477E2D4797E3F5F8DBD8E95B4DAA87A15E11E5C1E6ED51B6DCA979890F
SHA-512:	ECF4A35322240A8C9847995A27F88515FDC5FE788CAA1F82FD8C9283DF124385A045F10F535FF5591BBD4D3D11C58707A0A3DCD5727E53A64CE92BD402B0DF9D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABj4qI3W5LiSK8CzKrV+7jVEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJYnk5k082MlljTOYAUE7VEAAjXKrPEMNwnM1J7ySE3AAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2031089
Entropy (8bit):	4.001537973018971
Encrypted:	false
SSDEEP:	49152:MgPY2N/MR+DgVFIlq6h4N7X4VrgKk+lzlVSa4YVxeqOolcKRayjH09bnwBXQ0a/o:H
MD5:	AA1BB366DFB6F7329E0B9C53559E9040
SHA1:	19BF4BF1FF058D64893A2F1F9380F69E2BB3C764
SHA-256:	560BC596F2EECD88D3333C290F9DD6293FFB73F7CA808658D3B20631BA9F506A
SHA-512:	09760E2DAC774B9E5239ABE9B5ABFA70541E18B734241A0A4E3B538F4409212470068F3AC7BA85705B48BACD5A7272A280AFE5127CA32072B832FF3930095D83
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2031089
Entropy (8bit):	4.001537973018971
Encrypted:	false
SSDEEP:	49152:MgPY2N/MR+DgVFIlq6h4N7X4VrgKk+lzlVSa4YVxeqOolcKRayjH09bnwBXQ0a/o:H
MD5:	AA1BB366DFB6F7329E0B9C53559E9040
SHA1:	19BF4BF1FF058D64893A2F1F9380F69E2BB3C764
SHA-256:	560BC596F2EECD88D3333C290F9DD6293FFB73F7CA808658D3B20631BA9F506A
SHA-512:	09760E2DAC774B9E5239ABE9B5ABFA70541E18B734241A0A4E3B538F4409212470068F3AC7BA85705B48BACD5A7272A280AFE5127CA32072B832FF3930095D83
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl5gl:Ls3i
MD5:	002A27D6378009D6995EEC68332428A3
SHA1:	61C1A397B0C19AD5D12A9D10BD447E4F2DE4E79A
SHA-256:	9F6E19802358A453C061BCF4D259BD59A4DCCCB7247125208D94FD69C6C75094
SHA-512:	D5EAF4E3C076AF85C80F4C7353F75DFAE080899DB28692524BF42AA6B64267599CF50BC0CF40968C81E7BBC8CE57FE5C899AF58B9344A336FDF8A49C7E7D0C23
Malicious:	false
Preview:	............................................../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c2d484aa-426b-4936-b405-96da9af806ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24701
Entropy (8bit):	6.05237799233326
Encrypted:	false
SSDEEP:	384:qtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNxM1hMZfEazdHz7IEN555LI0G:OMGQ7FCYXGIgtDAWtJ4nj12ffHz7IUk
MD5:	47492B055725DBBBD8E31C2183554EE2
SHA1:	5B1084510CA2BCB81248F877BE073F8B15D68A5A
SHA-256:	E313CEFDC0A12D4365AFE2B1802AEB5F80E0CDB921B535F9A303AB2D50CE882E
SHA-512:	10F879A72644A628D65A7D2F8931505396EA853DC77080C9E30580A7E94F9846DA162FB3CA6DA6F86BC7FC7E37D5BC9084DD1927F9AC533607CAC173BF31C3B3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369897329511854","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c7699475-03da-470e-a6e1-cce8378d4293.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8333
Entropy (8bit):	5.798307873425959
Encrypted:	false
SSDEEP:	192:fsNwy1zhhzeiRUsSQGkfl6qRAq1k8SPxVLZ7VTiB:fsNwK1h3hLVfl6q3QxVNZTiB
MD5:	6C4E286F8A271F94255D70C85E8197AE
SHA1:	EF01BF86510FE46281C99F8612826B5F2DA66BE2
SHA-256:	2FEAA4987A43D9E35599E4F7590227C9B254569DE983167BAE82AA258D74F85D
SHA-512:	7EB1EAF21B10937C73F8F20D44318AF72D4FE899A09365D9C17EBC09C2EFE5297E6023EE83365BC6D124BC9FE1585A803541D6EBBE999379DF04E2289960F0CC
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\efcbe7ba-4e8f-4a57-a2ff-da5ca07f647d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9432
Entropy (8bit):	5.832180088347629
Encrypted:	false
SSDEEP:	192:fsNwy1zhhzeiRUs01MHQ5H6yCkfY96qRAq1k8SPxVLZ7VTiB:fsNwK1h3hEV5hBfY96q3QxVNZTiB
MD5:	4B7DDEAD009A06ED01281C8718C7BF83
SHA1:	7DF69875650F3A74843C957D04CD646A57427EE4
SHA-256:	C6056B4FD147EA60F6E33FAA1428A388865FA294B1B3CCEDDFC25FE70D9699BA
SHA-512:	BC2BBD3E87E2FDE4C70411383C7F136C7DC4011D823D2E0515F22BA63715C52692FF6F8A77090565D2107E1D2166C90A9FD048F0D6707FB4433E105012C63A08
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f7e83d45-5975-44fe-a7c6-210e04ad85da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8251
Entropy (8bit):	5.804652912066303
Encrypted:	false
SSDEEP:	192:fsNAy1zhhzeiRUdnQXkfl6qRAq1k8SPxVLZ7VTiQ:fsNAK1h3WQUfl6q3QxVNZTiQ
MD5:	BA7856E6AD8FCB3E140A7FF6A490D19E
SHA1:	7844A72647046271FFC686AAB597C03D0E0BC4D1
SHA-256:	BE417E213A01F230ECAFABB3BC918B1AB908CF23D58682D395793DF9D432B982
SHA-512:	1E80B0D200239288B6A3AC3998BDCD41A509870C7FDDD173B0A3D780E75251A58C1F3B70AB11F316AE170A2C07915D1D2E8EE825F266C783520D26F8EB5B5D60
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8379691486446714
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxvxl9Il8uJcIsXs7hbZfjkK9h+0DMRYlf1NPqEd1rc:mmYPIc7Lflz+0DMqfPqD
MD5:	34C7F29A73AC66618C4E45D9AC483FB9
SHA1:	37383A89F1982B91958CA8262B788A183B944F18
SHA-256:	8BF79F223C6F0AB65FA145D0539FDA5F8F242C6B874EA06AC4D596F718BE5E54
SHA-512:	B488C729033E180D2286FB9FF63A60B4A33C9BDEA8F90F8056830BB45BB3DFACC73DB2BBBD9DCE0A143CD5C47972752785E316231BDAB156CFC9A58C8C140A8A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N./.+.X.I.r.+.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Y.+.K.i.N.1.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000220145860319
Encrypted:	false
SSDEEP:	48:uiTrlKxExJxD9Il8uJcIsBoLQHaSRKk8NCukFs2xe8AP9kJd/79KBezi3ZMecuyu:XYPIaLNrk+216IlRcezgZ+uwRRvm
MD5:	F53D41B591F45F989D894774D4206B76
SHA1:	B50CC6607085E42CAF8078E078DE738C10CE131E
SHA-256:	A8AB95E890DFD2B6C59B5A7994A5588907AF2905F0A20343BD2BAFD539B9520B
SHA-512:	6CE4C35C423CD15EB6C87C8F7F1F02738E9B156B8E425231BD7027BFCC6CCF105C99414FF45155DC8E9AF8D7F9ABE27299CB95A90B188705FACE910F183E7723
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".w.i.f.T.Q.o.L.+.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Y.+.K.i.N.1.

C:\Users\user\AppData\Local\Temp\73a29cc3-f2a3-437f-9123-ff4a5fe2702e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\7efe0252-0731-47cf-889f-5748fa191a7e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\876b5195-df3b-4e4e-8211-58fc7c7fe852.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\b8359eee-41af-4695-adf1-a21578076241.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.340389601162432
Encrypted:	false
SSDEEP:	12:YkFPVXhfISL0Dkv/iJ1lL56s/iJ1XR90Dkv/iJ1Gp56s/C:YmTfVL0bN5QXR90bg5M
MD5:	498B9640F8A6F27D310FD8B5142E3243
SHA1:	EEB855877A12BB8076817966F3E02D1336D12811
SHA-256:	111568BFCBAD5CFA014286B6B727BB1FDE7AD20A0AD94AAD05CC4753579DDE8C
SHA-512:	BB2B01160E1F0F1A973C418DC0EA570F4F466CCE82DA9711D9549765C48C59A83629C2554785182605CE0FFB372D03DA3AF14264A4FEB324EE6D59977DA2A701
Malicious:	false
Preview:	{"logTime": "0904/042200", "correlationVector":"3D720471FDBA4A63BBEA0285E7501F78","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0904/042211", "correlationVector":"T0fVGRcVe7RyG6bjLxNCnF","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0904/042211", "correlationVector":"AD9D92529855403C917DC3D726898F05","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0904/042211", "correlationVector":"gUXH1VAsEDKDcJLyF+DP9k","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\7efe0252-0731-47cf-889f-5748fa191a7e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir3060_1910487945\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir3060_647570758\73a29cc3-f2a3-437f-9123-ff4a5fe2702e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir3060_647570758\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir3060_647570758\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir3060_647570758\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir3060_647570758\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.52404592792696
Encrypted:	false
SSDEEP:	48:EE9vSdOTvivsJYrezBdLXuHJkDpy2AdifdOTvzvsJYrezngdLXuHJk+21:P3upkDllnIupkz
MD5:	87E501D34230164CD71A1283156EBB9E
SHA1:	5D52C95BC6EDA4216BA9779A5F033751DB68E60B
SHA-256:	7C740B9F387AE3BE61F279DF604C8B8CF2E50E277B12D16B2CE4612B25FFC681
SHA-512:	4173B93BDDA6A1263AE5A7C54C24DA98F0665697E25CCD431E32E098BFE32078623D6B21D891FBD552FCFA782901215E4291847A19F6F99E60ADE29EC09FF1F0
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...........?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWR`..PROGRA~2.........O.IDWR`....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.$Y."..........................E...M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.$Y."..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.$Y."....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............Nz......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DWJ0RT39B5QBXA9V2QWA.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5223105222267916
Encrypted:	false
SSDEEP:	48:EEdifdOTvzvsJYrezBdLXuHJkDpy2AdifdOTvzvsJYrezngdLXuHJk+21:A3upkDllnIupkz
MD5:	7168DB7EC25FFE451E78D9841210C2C5
SHA1:	2E137011E0FA4B2708DB644EDA26EF2861859AF1
SHA-256:	252D85341825197D3B0FD055CFCEC8A5D7E3AB105A2FB21B8E3AC5DAD4825519
SHA-512:	F881DD5FA2E8301911693E070FCC47DF10DC3D9321803DE50FFCF57E8682AF8EF20DF254A174718024A807429F8545506F931D63A9132E4EDB84BDE962A20183
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...........?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....$Y."..PROGRA~2.........O.I$Y."....................V......*K.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.$Y."..........................E...M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.$Y."...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.$Y."..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.$Y."....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............Nz......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\H3SUYXR1LNK41AJRLYTE.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.52404592792696
Encrypted:	false
SSDEEP:	48:EE9vSdOTvivsJYrezBdLXuHJkDpy2AdifdOTvzvsJYrezngdLXuHJk+21:P3upkDllnIupkz
MD5:	87E501D34230164CD71A1283156EBB9E
SHA1:	5D52C95BC6EDA4216BA9779A5F033751DB68E60B
SHA-256:	7C740B9F387AE3BE61F279DF604C8B8CF2E50E277B12D16B2CE4612B25FFC681
SHA-512:	4173B93BDDA6A1263AE5A7C54C24DA98F0665697E25CCD431E32E098BFE32078623D6B21D891FBD552FCFA782901215E4291847A19F6F99E60ADE29EC09FF1F0
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...........?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWR`..PROGRA~2.........O.IDWR`....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.$Y."..........................E...M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.$Y."..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.$Y."....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............Nz......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5223105222267916
Encrypted:	false
SSDEEP:	48:EEdifdOTvzvsJYrezBdLXuHJkDpy2AdifdOTvzvsJYrezngdLXuHJk+21:A3upkDllnIupkz
MD5:	7168DB7EC25FFE451E78D9841210C2C5
SHA1:	2E137011E0FA4B2708DB644EDA26EF2861859AF1
SHA-256:	252D85341825197D3B0FD055CFCEC8A5D7E3AB105A2FB21B8E3AC5DAD4825519
SHA-512:	F881DD5FA2E8301911693E070FCC47DF10DC3D9321803DE50FFCF57E8682AF8EF20DF254A174718024A807429F8545506F931D63A9132E4EDB84BDE962A20183
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...........?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....$Y."..PROGRA~2.........O.I$Y."....................V......*K.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWP`..MICROS~1..D......(Ux.$Y."..........................E...M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.$Y."...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.$Y."..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.$Y."....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............Nz......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579761928283091
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	29602bd4c22f67125f6088e167b15765
SHA1:	5dc54cf559a0f6264ac26984307132fa0a67b6e7
SHA256:	4c519238b34233a799762539be743fec5361da87fbce57a33f02e5828bda9a7a
SHA512:	abb0b38b869f5c8283ddbe85e2cf37de00ee24fd1d939339b75fa3fc00491d829580d0ed17199307fc1cb4f9bc561b956bdb91c9a0bb1f57feb34cd12abc3ab6
SSDEEP:	12288:nqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacT6:nqDEvCTbMWu7rQYlBQcBiT6rprG8as6
TLSH:	18159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D7DED0 [Wed Sep 4 04:15:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F6D348EE023h
jmp 00007F6D348ED92Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F6D348EDB0Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F6D348EDADAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F6D348F06CDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F6D348F0718h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F6D348F0701h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	0c205f9a5d36fbaff8dcff32f84345a1	False	0.286953125	data	5.1649918620747535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 4, 2024 06:21:50.160578012 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 4, 2024 06:21:59.887300014 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 4, 2024 06:22:01.454215050 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:01.454238892 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:01.454375982 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:01.454726934 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:01.454739094 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:01.480407953 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:01.480426073 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:01.480535030 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:01.480726004 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:01.480735064 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.104079008 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.112509966 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.127068043 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.127077103 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.127938986 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.127995014 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.128566027 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.128577948 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.129436970 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.129488945 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.135948896 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.135998964 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.136193037 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.136244059 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.136811018 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.136816978 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.137160063 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.137165070 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.190653086 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.206223965 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.238351107 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238368988 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238375902 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238415003 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238428116 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238439083 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238482952 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.238492966 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238526106 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238544941 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238552094 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238574028 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238584995 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238593102 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238634109 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.238652945 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.238652945 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.238658905 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.238658905 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.238658905 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.238658905 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.238678932 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.323860884 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.323877096 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.324069977 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.324069977 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.324083090 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.324997902 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.325016975 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.325061083 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.325067997 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.325088024 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.325120926 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.406894922 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.406910896 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.406976938 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.406985998 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.407042980 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.407361984 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.407412052 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.407418966 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.407429934 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.407466888 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.414700985 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.414724112 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.414875984 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.415170908 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.415184975 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.415296078 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.415467978 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.415476084 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.415865898 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.415884972 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.415934086 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.416295052 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.416306019 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.416448116 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.416459084 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.450237036 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:02.450254917 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:02.450316906 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:02.452137947 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:02.452147007 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:02.523559093 CEST	49747	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.523571968 CEST	443	49747	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.528275967 CEST	49748	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:02.528285027 CEST	443	49748	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:02.690664053 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:02.690690041 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:02.690805912 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:02.691459894 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:02.691471100 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:02.871381044 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.871608019 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.871618986 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.872592926 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.872652054 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.873698950 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.873754025 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.873871088 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.873876095 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.875077009 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.875281096 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.875286102 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.876287937 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.876348972 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.877263069 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.877310038 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.877465010 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.877469063 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.879300117 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.879585981 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.879591942 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.880822897 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.880881071 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.881803989 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.881962061 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.881977081 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.923456907 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:02.923641920 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:02.923650026 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:02.924626112 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:02.924681902 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:02.925410032 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.925574064 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.925757885 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:02.925812006 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:02.925894976 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:02.925899982 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:02.972309113 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:02.975526094 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.975533962 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.988384962 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.988440037 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:02.988512039 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.988708019 CEST	49751	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:02.988718033 CEST	443	49751	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:03.003150940 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:03.003206015 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:03.003379107 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:03.003457069 CEST	49753	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:03.003468037 CEST	443	49753	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:03.005595922 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:03.005647898 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:03.005775928 CEST	49752	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:03.005781889 CEST	443	49752	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:03.038152933 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.038197994 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.038315058 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.038407087 CEST	49754	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.038412094 CEST	443	49754	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.176028013 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.176379919 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.176388025 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.177397966 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.177473068 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.178488016 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.178554058 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.178658009 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.220500946 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.251682043 CEST	49759	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:03.251704931 CEST	443	49759	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:03.251929998 CEST	49759	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:03.254317999 CEST	49759	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:03.254331112 CEST	443	49759	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:03.296581984 CEST	49760	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.296607971 CEST	443	49760	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.296684027 CEST	49760	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.296891928 CEST	49760	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.296906948 CEST	443	49760	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.316063881 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.316071987 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.320199966 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.320286036 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.320462942 CEST	49758	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.320472002 CEST	443	49758	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.773850918 CEST	443	49760	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.774322987 CEST	49760	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.774334908 CEST	443	49760	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.775060892 CEST	443	49760	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.778757095 CEST	49760	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.778929949 CEST	49760	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.778943062 CEST	443	49760	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.820730925 CEST	49760	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.897821903 CEST	443	49760	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.897885084 CEST	443	49760	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.901179075 CEST	49760	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.901262999 CEST	49760	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:03.901279926 CEST	443	49760	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:03.926218987 CEST	443	49759	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:03.926315069 CEST	49759	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:03.930721045 CEST	49759	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:03.930728912 CEST	443	49759	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:03.930980921 CEST	443	49759	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:03.973932028 CEST	49759	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:04.000884056 CEST	49759	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:04.037643909 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.037643909 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.037679911 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.037689924 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.037758112 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.037758112 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.038034916 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.038034916 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.038049936 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.038069010 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.048491001 CEST	443	49759	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:04.203404903 CEST	443	49759	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:04.203460932 CEST	443	49759	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:04.203622103 CEST	49759	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:04.203622103 CEST	49759	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:04.203661919 CEST	443	49759	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:04.203696012 CEST	49759	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:04.203702927 CEST	443	49759	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:04.246480942 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:04.246505022 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:04.246733904 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:04.247102022 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:04.247111082 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:04.472476959 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.472491980 CEST	443	49764	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.472546101 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.472748995 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.472769022 CEST	443	49765	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.472819090 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.472976923 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.472986937 CEST	443	49764	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.473088026 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.473098040 CEST	443	49765	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.497977972 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.498454094 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.498476028 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.498779058 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.499461889 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.499521971 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.519025087 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.545818090 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.545838118 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.546238899 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.547447920 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.547949076 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.548023939 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.711406946 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.774076939 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:04.774091005 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:04.774152994 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:04.774319887 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:04.774331093 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:04.899209976 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:04.899271965 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:04.900619030 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:04.900624990 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:04.900825024 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:04.902038097 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:04.942559958 CEST	443	49764	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.943639994 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.943645954 CEST	443	49764	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.944505930 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:04.944915056 CEST	443	49764	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.944977045 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.945522070 CEST	443	49764	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.945566893 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.947318077 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.947371960 CEST	443	49764	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.948046923 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.948051929 CEST	443	49764	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.955539942 CEST	443	49765	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.955990076 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.955998898 CEST	443	49765	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.956300020 CEST	443	49765	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.956355095 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.956948042 CEST	443	49765	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.956999063 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.957304001 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.957357883 CEST	443	49765	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.957875967 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:04.957880974 CEST	443	49765	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:04.988801003 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.004945040 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.055437088 CEST	443	49764	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.055705070 CEST	443	49764	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.055752993 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.056122065 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.056134939 CEST	443	49764	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.056143045 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.056175947 CEST	49764	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.072107077 CEST	443	49765	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.072238922 CEST	443	49765	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.072289944 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.072638988 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.072647095 CEST	443	49765	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.072659969 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.072694063 CEST	49765	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.183300018 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:05.183353901 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:05.183432102 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:05.184575081 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:05.184581995 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:05.184602976 CEST	49763	443	192.168.2.4	184.28.90.27
Sep 4, 2024 06:22:05.184607983 CEST	443	49763	184.28.90.27	192.168.2.4
Sep 4, 2024 06:22:05.263977051 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.264270067 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:05.264298916 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.265162945 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.265227079 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:05.266370058 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:05.266423941 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.266666889 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:05.266675949 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.315416098 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:05.364695072 CEST	49767	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.364725113 CEST	443	49767	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.364794016 CEST	49767	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.364980936 CEST	49767	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.364991903 CEST	443	49767	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.367012978 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.367048025 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.367074013 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.367086887 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:05.367094994 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.367119074 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.367158890 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:05.367166996 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.367209911 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:05.367326021 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.367357016 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.367398977 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:05.368069887 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:05.368077993 CEST	443	49766	142.250.81.228	192.168.2.4
Sep 4, 2024 06:22:05.368086100 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:05.368123055 CEST	49766	443	192.168.2.4	142.250.81.228
Sep 4, 2024 06:22:05.380449057 CEST	49768	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.380459070 CEST	443	49768	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.380510092 CEST	49768	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.380671024 CEST	49768	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.380678892 CEST	443	49768	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.822443008 CEST	443	49767	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.822669983 CEST	49767	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.822685957 CEST	443	49767	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.822998047 CEST	443	49767	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.823208094 CEST	49767	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.823604107 CEST	443	49767	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.823692083 CEST	49767	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.823894978 CEST	49767	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.823945045 CEST	443	49767	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.869154930 CEST	443	49768	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.869410992 CEST	49768	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.869420052 CEST	443	49768	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.869761944 CEST	443	49768	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.870034933 CEST	49768	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.870480061 CEST	443	49768	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.870589018 CEST	49768	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.870744944 CEST	49768	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.870799065 CEST	443	49768	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.877363920 CEST	49767	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.877370119 CEST	443	49767	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.926743984 CEST	49767	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:06.003017902 CEST	49768	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:06.003026009 CEST	443	49768	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:06.113261938 CEST	49768	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:12.433578014 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:12.433623075 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:12.433731079 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:12.443995953 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:12.444011927 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:12.496254921 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:12.496292114 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:12.496354103 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:12.496557951 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:12.496573925 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:12.546931982 CEST	49777	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:12.546969891 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:12.547033072 CEST	49777	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:12.547230959 CEST	49777	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:12.547246933 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:12.889462948 CEST	49672	443	192.168.2.4	173.222.162.32
Sep 4, 2024 06:22:12.889503956 CEST	443	49672	173.222.162.32	192.168.2.4
Sep 4, 2024 06:22:13.192450047 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:13.192528009 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:13.196368933 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:13.196378946 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:13.196597099 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:13.237760067 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:13.254463911 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.254756927 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.254786968 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.254920006 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:13.255119085 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.255131006 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.255153894 CEST	49777	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:13.255165100 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:13.255182981 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.255189896 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.255203009 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.255224943 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.255723953 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.256027937 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:13.256079912 CEST	49777	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:13.257534027 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.257608891 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.257699966 CEST	49777	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:13.257756948 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:13.257806063 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.257813931 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.257976055 CEST	49777	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:13.257982969 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:13.300254107 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.300277948 CEST	49777	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:13.430866957 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:13.430892944 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:13.430901051 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:13.430928946 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:13.430959940 CEST	49777	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:13.430968046 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:13.430999041 CEST	49777	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:13.431009054 CEST	49777	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:13.434909105 CEST	49777	443	192.168.2.4	13.107.246.60
Sep 4, 2024 06:22:13.434931040 CEST	443	49777	13.107.246.60	192.168.2.4
Sep 4, 2024 06:22:13.525012016 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.525046110 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.525240898 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.525260925 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.527966976 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.528019905 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.528028965 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.534446955 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.534492016 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.534499884 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.541062117 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.541189909 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.541199923 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.546809912 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.546859980 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.546869040 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.553332090 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.553383112 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.553391933 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.560497046 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.560559034 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.560568094 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.567348003 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.567418098 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.567425013 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.612766981 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.617432117 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.617481947 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.617508888 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.617533922 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.617544889 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.617587090 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.620695114 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.626898050 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.626921892 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.626950026 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.626966000 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.627089977 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.633095026 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.639446020 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.639472961 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.639493942 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.639503002 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.639548063 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.645700932 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.651853085 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.651905060 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.651912928 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.658304930 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.658333063 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.658401012 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.658410072 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.658456087 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.664105892 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.669428110 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.669481039 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.669487000 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.674927950 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.674979925 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.674990892 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.675000906 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.675046921 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.680454969 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.685884953 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.685906887 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.685956001 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.685962915 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.686011076 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.692728996 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.697247982 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.697276115 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.697314024 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.697324038 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.697367907 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.702986956 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.709736109 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.709762096 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.709822893 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.709832907 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.709877014 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.709981918 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.713799000 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.713820934 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.713850021 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.713859081 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.713906050 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.717267036 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.720712900 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.720791101 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.720798969 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.720807076 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.720865011 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.724179029 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.727621078 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.727670908 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.727684021 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.727698088 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.727768898 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.731236935 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.734628916 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.734711885 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.734720945 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.738172054 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.738198042 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.738241911 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.738251925 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.738296032 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.743441105 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.746813059 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.746840000 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.746870995 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.746885061 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.746927977 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.748624086 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.752057076 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.752142906 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.752166033 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.752176046 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.752223015 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.755505085 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.759171963 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.759196997 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.759255886 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.759269953 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.759311914 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.762536049 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.767257929 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.767286062 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.767618895 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.767637014 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.767680883 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.772663116 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.772758007 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.772788048 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.772829056 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.772840023 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.772881031 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.778080940 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.779195070 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.779258966 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.779311895 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.779325008 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.779369116 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.784914970 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.785024881 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.785073996 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.785093069 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.786102057 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.786984921 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.786995888 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.789019108 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:13.791023970 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.885291100 CEST	49776	443	192.168.2.4	172.217.16.193
Sep 4, 2024 06:22:13.885318995 CEST	443	49776	172.217.16.193	192.168.2.4
Sep 4, 2024 06:22:14.096256971 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:14.136512041 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:14.497431040 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:14.497450113 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:14.497457027 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:14.497473001 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:14.497507095 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:14.497520924 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:14.497556925 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:14.497572899 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:14.497572899 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:14.497603893 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:14.497829914 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:14.497886896 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:14.497895002 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:14.497946978 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:14.497993946 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:15.004750967 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:15.004782915 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:15.004797935 CEST	49775	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:15.004805088 CEST	443	49775	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:16.066436052 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.066468954 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.066560984 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.067522049 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.067537069 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.067854881 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:16.067879915 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:16.068450928 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:16.068674088 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:16.068689108 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:16.125179052 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.125202894 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.125750065 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.126441956 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.126458883 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.519289017 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:16.532444954 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.552436113 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.552462101 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.552757025 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:16.552777052 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:16.553445101 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.553508997 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.553709984 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:16.553776979 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:16.554924011 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.554980993 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.555433989 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.555443048 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.556215048 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:16.556298971 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:16.556385040 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:16.584549904 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.587268114 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.587284088 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.588269949 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.588335037 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.589562893 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.589632988 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.589768887 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.589782953 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.596514940 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:16.598530054 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.598686934 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:16.598695993 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:16.645684004 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:16.659405947 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:16.659452915 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:16.659514904 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:16.659862995 CEST	49786	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:16.659883022 CEST	443	49786	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:16.659989119 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.660042048 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.660119057 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.660881042 CEST	49785	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.660909891 CEST	443	49785	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.707607031 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.710470915 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.710513115 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:16.710593939 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.710845947 CEST	49787	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:16.710854053 CEST	443	49787	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:19.112016916 CEST	62563	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:19.120480061 CEST	53	62563	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:19.120574951 CEST	62563	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:19.122368097 CEST	62563	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:19.127736092 CEST	53	62563	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:20.336004972 CEST	53	62563	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:20.336041927 CEST	53	62563	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:20.336057901 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:20.336095095 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:20.336124897 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:20.336132050 CEST	62563	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:20.336167097 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:20.336184025 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:20.336196899 CEST	53	62563	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:20.336234093 CEST	62563	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:20.336296082 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:20.337095022 CEST	62563	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:20.338958025 CEST	62564	443	192.168.2.4	152.195.19.97
Sep 4, 2024 06:22:20.338989019 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:20.339061022 CEST	62564	443	192.168.2.4	152.195.19.97
Sep 4, 2024 06:22:20.339282990 CEST	62564	443	192.168.2.4	152.195.19.97
Sep 4, 2024 06:22:20.339293957 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:20.342176914 CEST	53	62563	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:20.342227936 CEST	62563	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:20.903378010 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:20.949130058 CEST	62564	443	192.168.2.4	152.195.19.97
Sep 4, 2024 06:22:21.014982939 CEST	62564	443	192.168.2.4	152.195.19.97
Sep 4, 2024 06:22:21.014991045 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:21.016149044 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:21.019007921 CEST	62564	443	192.168.2.4	152.195.19.97
Sep 4, 2024 06:22:21.066982985 CEST	62564	443	192.168.2.4	152.195.19.97
Sep 4, 2024 06:22:21.067073107 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:21.070983887 CEST	62564	443	192.168.2.4	152.195.19.97
Sep 4, 2024 06:22:21.071000099 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:21.125313997 CEST	62564	443	192.168.2.4	152.195.19.97
Sep 4, 2024 06:22:21.169156075 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:21.169521093 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:21.169528008 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:21.169543982 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:21.169553995 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:21.169600964 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:21.169612885 CEST	62564	443	192.168.2.4	152.195.19.97
Sep 4, 2024 06:22:21.169672966 CEST	62564	443	192.168.2.4	152.195.19.97
Sep 4, 2024 06:22:21.170846939 CEST	62564	443	192.168.2.4	152.195.19.97
Sep 4, 2024 06:22:21.170870066 CEST	443	62564	152.195.19.97	192.168.2.4
Sep 4, 2024 06:22:21.552697897 CEST	62565	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:21.552728891 CEST	443	62565	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:21.552887917 CEST	62565	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:21.553024054 CEST	62566	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:21.553030968 CEST	443	62566	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:21.553112030 CEST	62566	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:21.554141998 CEST	62565	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:21.554155111 CEST	443	62565	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:21.554984093 CEST	62566	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:21.554989100 CEST	443	62566	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:21.555351973 CEST	62567	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:21.555351973 CEST	62568	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:21.555366993 CEST	443	62567	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:21.555377007 CEST	443	62568	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:21.555439949 CEST	62567	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:21.555576086 CEST	62568	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:21.555644989 CEST	62568	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:21.555653095 CEST	443	62568	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:21.555866003 CEST	62567	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:21.555875063 CEST	443	62567	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.005290985 CEST	443	62565	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.008769989 CEST	443	62568	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.010525942 CEST	62565	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.010544062 CEST	443	62565	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.010741949 CEST	62568	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.010749102 CEST	443	62568	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.010979891 CEST	443	62565	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.011111021 CEST	443	62568	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.012505054 CEST	62565	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.012578964 CEST	443	62565	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.013073921 CEST	62568	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.013135910 CEST	443	62568	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.015381098 CEST	62565	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.017147064 CEST	443	62567	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.020052910 CEST	62567	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.020061970 CEST	443	62567	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.020390034 CEST	443	62567	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.021254063 CEST	62567	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.021311998 CEST	443	62567	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.038641930 CEST	443	62566	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.038886070 CEST	62566	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.038892984 CEST	443	62566	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.039199114 CEST	443	62566	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.039671898 CEST	62566	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.039725065 CEST	443	62566	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.060498953 CEST	443	62565	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.065515995 CEST	62567	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.065515995 CEST	62568	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.081181049 CEST	62566	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.128751040 CEST	443	62565	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.128827095 CEST	443	62565	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.128881931 CEST	62565	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.128964901 CEST	62565	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.128976107 CEST	443	62565	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:33.128407001 CEST	80	49723	125.39.194.1	192.168.2.4
Sep 4, 2024 06:22:33.134994030 CEST	49723	80	192.168.2.4	125.39.194.1
Sep 4, 2024 06:22:33.152985096 CEST	49723	80	192.168.2.4	125.39.194.1
Sep 4, 2024 06:22:33.157854080 CEST	80	49723	125.39.194.1	192.168.2.4
Sep 4, 2024 06:22:36.918982029 CEST	443	62568	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:36.919054031 CEST	443	62568	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:36.919220924 CEST	62568	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:36.926978111 CEST	443	62567	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:36.927037954 CEST	443	62567	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:36.927087069 CEST	62567	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:36.941147089 CEST	443	62566	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:36.941217899 CEST	443	62566	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:36.941281080 CEST	62566	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:48.273638964 CEST	80	49724	125.39.194.1	192.168.2.4
Sep 4, 2024 06:22:48.273765087 CEST	49724	80	192.168.2.4	125.39.194.1
Sep 4, 2024 06:22:48.273813009 CEST	49724	80	192.168.2.4	125.39.194.1
Sep 4, 2024 06:22:48.278624058 CEST	80	49724	125.39.194.1	192.168.2.4
Sep 4, 2024 06:22:50.881366968 CEST	49767	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:50.881400108 CEST	443	49767	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:51.004471064 CEST	49768	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:51.004488945 CEST	443	49768	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:51.358125925 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:51.358166933 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:51.358243942 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:51.358670950 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:51.358685017 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.046355963 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.046520948 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:52.108525991 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:52.108562946 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.108853102 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.141201019 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:52.188499928 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.456656933 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.456700087 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.456724882 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.456732035 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.456757069 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:52.456780910 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.456804991 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:52.456830025 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:52.462259054 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.462286949 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.462347031 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:52.462354898 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.462366104 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.462368011 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:52.462421894 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:52.462552071 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:52.462564945 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:52.462599039 CEST	62571	443	192.168.2.4	52.165.165.26
Sep 4, 2024 06:22:52.462604046 CEST	443	62571	52.165.165.26	192.168.2.4
Sep 4, 2024 06:22:56.226342916 CEST	62572	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.226368904 CEST	443	62572	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.226440907 CEST	62572	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.226512909 CEST	62573	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.226530075 CEST	443	62573	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.226584911 CEST	62573	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.226680040 CEST	62572	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.226695061 CEST	443	62572	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.226788044 CEST	62573	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.226794958 CEST	443	62573	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.679441929 CEST	443	62572	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.679778099 CEST	62572	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.679800034 CEST	443	62572	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.680114031 CEST	443	62572	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.680613995 CEST	62572	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.680675983 CEST	443	62572	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.701118946 CEST	443	62573	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.701340914 CEST	62573	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.701348066 CEST	443	62573	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.701670885 CEST	443	62573	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.702162981 CEST	62573	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.702219009 CEST	443	62573	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.722655058 CEST	62572	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.753833055 CEST	62573	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.347017050 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.347048044 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:05.347176075 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.347181082 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:10.397386074 CEST	62568	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:10.397413015 CEST	443	62568	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:10.397450924 CEST	62567	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:10.397459984 CEST	443	62567	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:11.593626976 CEST	443	62572	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:11.593698978 CEST	443	62572	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:11.593847990 CEST	62572	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:11.605922937 CEST	443	62573	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:11.605995893 CEST	443	62573	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:11.606045961 CEST	62573	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:21.941868067 CEST	62566	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:21.941888094 CEST	443	62566	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:35.894603014 CEST	49767	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:23:35.894633055 CEST	443	49767	142.251.40.238	192.168.2.4
Sep 4, 2024 06:23:36.004620075 CEST	49768	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:23:36.004654884 CEST	443	49768	142.251.40.238	192.168.2.4
Sep 4, 2024 06:23:50.348392010 CEST	49762	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:50.348411083 CEST	443	49762	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:50.348439932 CEST	49761	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:50.348447084 CEST	443	49761	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:56.597152948 CEST	62572	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:56.597177982 CEST	443	62572	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:56.612776041 CEST	62573	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:56.612797022 CEST	443	62573	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:59.123332977 CEST	62577	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.123378038 CEST	443	62577	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.123440981 CEST	62577	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.123639107 CEST	62578	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.123647928 CEST	443	62578	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.123820066 CEST	62577	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.123833895 CEST	443	62577	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.123843908 CEST	62578	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.123960972 CEST	62578	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.123970985 CEST	443	62578	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.577668905 CEST	443	62577	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.579325914 CEST	62577	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.579351902 CEST	443	62577	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.579713106 CEST	443	62577	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.583393097 CEST	62577	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.583472967 CEST	443	62577	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.598032951 CEST	443	62578	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.599359989 CEST	62578	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.599370003 CEST	443	62578	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.599700928 CEST	443	62578	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.603379011 CEST	62578	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.603456974 CEST	443	62578	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.626859903 CEST	62577	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.649255991 CEST	62578	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.671180010 CEST	62579	443	192.168.2.4	23.219.161.132
Sep 4, 2024 06:23:59.671224117 CEST	443	62579	23.219.161.132	192.168.2.4
Sep 4, 2024 06:23:59.671304941 CEST	62579	443	192.168.2.4	23.219.161.132
Sep 4, 2024 06:23:59.671489000 CEST	62579	443	192.168.2.4	23.219.161.132
Sep 4, 2024 06:23:59.671500921 CEST	443	62579	23.219.161.132	192.168.2.4
Sep 4, 2024 06:24:00.149492025 CEST	443	62579	23.219.161.132	192.168.2.4
Sep 4, 2024 06:24:00.149930000 CEST	62579	443	192.168.2.4	23.219.161.132
Sep 4, 2024 06:24:00.149940014 CEST	443	62579	23.219.161.132	192.168.2.4
Sep 4, 2024 06:24:00.150284052 CEST	443	62579	23.219.161.132	192.168.2.4
Sep 4, 2024 06:24:00.150831938 CEST	62579	443	192.168.2.4	23.219.161.132
Sep 4, 2024 06:24:00.150891066 CEST	443	62579	23.219.161.132	192.168.2.4
Sep 4, 2024 06:24:00.151057959 CEST	62579	443	192.168.2.4	23.219.161.132
Sep 4, 2024 06:24:00.192503929 CEST	443	62579	23.219.161.132	192.168.2.4
Sep 4, 2024 06:24:00.290942907 CEST	443	62579	23.219.161.132	192.168.2.4
Sep 4, 2024 06:24:00.291024923 CEST	443	62579	23.219.161.132	192.168.2.4
Sep 4, 2024 06:24:00.291066885 CEST	62579	443	192.168.2.4	23.219.161.132
Sep 4, 2024 06:24:00.291939974 CEST	62579	443	192.168.2.4	23.219.161.132
Sep 4, 2024 06:24:00.291963100 CEST	443	62579	23.219.161.132	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 4, 2024 06:21:58.222879887 CEST	53	62924	1.1.1.1	192.168.2.4
Sep 4, 2024 06:21:59.107542992 CEST	64509	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:21:59.108062029 CEST	60491	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:00.465691090 CEST	53	57242	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:00.474282980 CEST	53	55229	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:02.404618025 CEST	52613	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:02.406795979 CEST	51397	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:02.407510996 CEST	63539	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:02.407650948 CEST	61735	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:02.408198118 CEST	61979	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:02.408476114 CEST	63279	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:02.409013987 CEST	62730	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:02.411874056 CEST	53	52613	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:02.413661003 CEST	52451	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:02.413927078 CEST	53	51397	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:02.414169073 CEST	53	61735	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:02.414377928 CEST	53	63539	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:02.415081024 CEST	53	61979	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:02.415242910 CEST	53	63279	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:02.415569067 CEST	53	62730	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:02.420856953 CEST	53	52451	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:02.520998001 CEST	58965	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:02.521198034 CEST	62500	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:02.689527035 CEST	53	58965	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:02.689618111 CEST	53	62500	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:03.732055902 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.037132025 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.191420078 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.191433907 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.191446066 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.191451073 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.191536903 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.192044020 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.194036007 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.197530031 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.197671890 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.198208094 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.198208094 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.295264959 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.295321941 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.295331955 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.295341015 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.295785904 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.296031952 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.296376944 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.297318935 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.297508955 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.298363924 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.371781111 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.372035980 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.393385887 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.434747934 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.470707893 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.470937014 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.471153975 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.471647024 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.666553020 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.666819096 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:04.765197039 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.765909910 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.766300917 CEST	443	62728	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:04.768281937 CEST	62728	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:05.057775021 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.364243984 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.504425049 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.504439116 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.510837078 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.510848999 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.510859013 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.510878086 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.526936054 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.527050018 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.528225899 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.528942108 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.529073000 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.529498100 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.529687881 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.622220039 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.622410059 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.622661114 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.623157024 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.637262106 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.637583017 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.639261961 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:05.642251968 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:05.735858917 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:12.487715006 CEST	52417	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:12.488054991 CEST	50062	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:12.494298935 CEST	53	52417	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:12.495748043 CEST	53	50062	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:13.540276051 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:13.540309906 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:13.633940935 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:13.663820028 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:13.664097071 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:13.664350033 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:13.664541960 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:13.707211971 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:13.782737017 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:15.557210922 CEST	53	58847	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:16.050968885 CEST	58735	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:16.051481962 CEST	64919	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:16.052048922 CEST	61269	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:16.052181959 CEST	56475	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:16.065264940 CEST	53	64919	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:16.065490007 CEST	53	56475	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:16.065500021 CEST	53	61269	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:16.066416979 CEST	53	58735	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:16.117580891 CEST	59832	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:16.117743969 CEST	52271	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:22:16.124466896 CEST	53	52271	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:16.124497890 CEST	53	59832	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:17.886791945 CEST	138	138	192.168.2.4	192.168.2.255
Sep 4, 2024 06:22:19.111469984 CEST	53	58470	1.1.1.1	192.168.2.4
Sep 4, 2024 06:22:21.551860094 CEST	62081	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:21.554754019 CEST	58194	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:21.862632036 CEST	62081	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:21.862935066 CEST	58194	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.007091999 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.007116079 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.007128000 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.007203102 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.007214069 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.011387110 CEST	58194	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.013839960 CEST	58194	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.014077902 CEST	58194	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.015079021 CEST	58194	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.015207052 CEST	58194	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.016839027 CEST	443	62081	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.016943932 CEST	443	62081	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.016953945 CEST	443	62081	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.016974926 CEST	443	62081	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.016987085 CEST	443	62081	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.017683029 CEST	62081	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.018942118 CEST	62081	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.019524097 CEST	62081	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.019610882 CEST	62081	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.020968914 CEST	62081	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.108047962 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.108061075 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.108068943 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.108072996 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.108618975 CEST	58194	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.108768940 CEST	58194	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.112459898 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.113722086 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.113822937 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.114070892 CEST	58194	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.116674900 CEST	443	62081	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.116684914 CEST	443	62081	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.116692066 CEST	443	62081	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.116699934 CEST	443	62081	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.116987944 CEST	62081	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.117059946 CEST	62081	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.118618011 CEST	443	62081	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.119601011 CEST	443	62081	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.159419060 CEST	62081	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:22.203676939 CEST	443	58194	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:22.214401007 CEST	443	62081	162.159.61.3	192.168.2.4
Sep 4, 2024 06:22:22.237478018 CEST	58194	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:22.253102064 CEST	62081	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:22:34.454576969 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:34.454874992 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:34.548381090 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:34.562376976 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:34.562473059 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:34.563961983 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:34.596827984 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:34.683677912 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:34.930912018 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:34.931029081 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:35.025028944 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:35.039393902 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:35.039634943 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:35.039697886 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:35.069025993 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:35.103872061 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:35.103972912 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:35.158209085 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:35.197720051 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:35.211618900 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:35.211853981 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:35.212057114 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:35.244858980 CEST	58473	443	192.168.2.4	142.251.40.238
Sep 4, 2024 06:22:35.330451012 CEST	443	58473	142.251.40.238	192.168.2.4
Sep 4, 2024 06:22:56.226130009 CEST	58349	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.536820889 CEST	58349	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.677576065 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.677611113 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.677633047 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.677644014 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.677683115 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.678262949 CEST	58349	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.680135965 CEST	58349	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.680301905 CEST	58349	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.680864096 CEST	58349	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.681108952 CEST	58349	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.774537086 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.774672031 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.774682999 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.774691105 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.775065899 CEST	58349	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.775120020 CEST	58349	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.775768042 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.776850939 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.777468920 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.777620077 CEST	58349	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:22:56.869405985 CEST	443	58349	172.64.41.3	192.168.2.4
Sep 4, 2024 06:22:56.910257101 CEST	58349	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.399518013 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.399686098 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.400039911 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.400176048 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.785480976 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.847210884 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:05.848264933 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.879283905 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.881483078 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:05.881494999 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:05.881501913 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:05.881510019 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:05.881813049 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.881895065 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.943804979 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:05.971702099 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:05.977129936 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:05.977349997 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:06.074377060 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:06.074640989 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:06.074970007 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:06.075192928 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:06.075898886 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.076041937 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.411508083 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.534302950 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.541199923 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.541214943 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.558655024 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.568660021 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.570559978 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.572276115 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.572304964 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.572583914 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.572602987 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.573064089 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:06.573182106 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:06.663229942 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.667741060 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.667859077 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.668162107 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.669337034 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:06.670386076 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:06.670669079 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:06.683159113 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.683171034 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.683180094 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.827687025 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:06.827881098 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.828063011 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.828145981 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.830104113 CEST	62640	443	192.168.2.4	142.251.179.84
Sep 4, 2024 06:23:06.830275059 CEST	62640	443	192.168.2.4	142.251.179.84
Sep 4, 2024 06:23:06.881874084 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.887096882 CEST	443	54485	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:06.904464960 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.906311035 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:06.922698975 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:06.923187971 CEST	54485	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:07.281045914 CEST	443	62640	142.251.179.84	192.168.2.4
Sep 4, 2024 06:23:07.281979084 CEST	443	62640	142.251.179.84	192.168.2.4
Sep 4, 2024 06:23:07.282021999 CEST	443	62640	142.251.179.84	192.168.2.4
Sep 4, 2024 06:23:07.282033920 CEST	443	62640	142.251.179.84	192.168.2.4
Sep 4, 2024 06:23:07.282047033 CEST	443	62640	142.251.179.84	192.168.2.4
Sep 4, 2024 06:23:07.282236099 CEST	62640	443	192.168.2.4	142.251.179.84
Sep 4, 2024 06:23:07.282913923 CEST	62640	443	192.168.2.4	142.251.179.84
Sep 4, 2024 06:23:07.283154011 CEST	62640	443	192.168.2.4	142.251.179.84
Sep 4, 2024 06:23:07.384924889 CEST	443	62640	142.251.179.84	192.168.2.4
Sep 4, 2024 06:23:07.384949923 CEST	443	62640	142.251.179.84	192.168.2.4
Sep 4, 2024 06:23:07.384958029 CEST	443	62640	142.251.179.84	192.168.2.4
Sep 4, 2024 06:23:07.385409117 CEST	62640	443	192.168.2.4	142.251.179.84
Sep 4, 2024 06:23:07.420768023 CEST	443	62640	142.251.179.84	192.168.2.4
Sep 4, 2024 06:23:07.420813084 CEST	443	62640	142.251.179.84	192.168.2.4
Sep 4, 2024 06:23:07.421030045 CEST	62640	443	192.168.2.4	142.251.179.84
Sep 4, 2024 06:23:07.456701994 CEST	62640	443	192.168.2.4	142.251.179.84
Sep 4, 2024 06:23:07.548938036 CEST	443	62640	142.251.179.84	192.168.2.4
Sep 4, 2024 06:23:35.819256067 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:35.916548014 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:35.917128086 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:35.917232990 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:35.939868927 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:36.015773058 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:36.029730082 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:36.029740095 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:36.030086994 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:36.066827059 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:36.150177956 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:36.555154085 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:36.555205107 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:36.650660038 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:36.664541006 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:36.664551973 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:36.664848089 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:36.691153049 CEST	57783	443	192.168.2.4	142.251.35.174
Sep 4, 2024 06:23:36.784533024 CEST	443	57783	142.251.35.174	192.168.2.4
Sep 4, 2024 06:23:46.553801060 CEST	63024	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:46.554008961 CEST	63024	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:46.554320097 CEST	63024	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:46.554421902 CEST	63024	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:46.957755089 CEST	63024	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:47.000360966 CEST	443	63024	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:47.001188040 CEST	63024	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:47.035918951 CEST	63024	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:47.052383900 CEST	443	63024	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:47.052396059 CEST	443	63024	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:47.052402973 CEST	443	63024	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:47.052407026 CEST	443	63024	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:47.052782059 CEST	63024	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:47.052865982 CEST	63024	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:47.095614910 CEST	443	63024	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:47.130359888 CEST	63024	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:47.147156954 CEST	443	63024	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:47.147471905 CEST	63024	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:47.242918015 CEST	443	63024	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:47.243769884 CEST	443	63024	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:47.243838072 CEST	443	63024	172.64.41.3	192.168.2.4
Sep 4, 2024 06:23:47.244098902 CEST	63024	443	192.168.2.4	172.64.41.3
Sep 4, 2024 06:23:59.111323118 CEST	54241	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:23:59.111468077 CEST	65345	53	192.168.2.4	1.1.1.1
Sep 4, 2024 06:23:59.118088961 CEST	53	54241	1.1.1.1	192.168.2.4
Sep 4, 2024 06:23:59.118110895 CEST	53	65345	1.1.1.1	192.168.2.4
Sep 4, 2024 06:23:59.123064995 CEST	54921	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.425183058 CEST	54921	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.569010019 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.569032907 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.569118023 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.569128036 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.569143057 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.569736004 CEST	54921	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.571589947 CEST	54921	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.571706057 CEST	54921	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.571952105 CEST	54921	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.572081089 CEST	54921	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.667323112 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.667351007 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.667361021 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.667370081 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.667380095 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.667757034 CEST	54921	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.667855978 CEST	54921	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.668534040 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.670116901 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.670439959 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.670711040 CEST	54921	443	192.168.2.4	162.159.61.3
Sep 4, 2024 06:23:59.763000965 CEST	443	54921	162.159.61.3	192.168.2.4
Sep 4, 2024 06:23:59.789516926 CEST	54921	443	192.168.2.4	162.159.61.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 4, 2024 06:21:59.107542992 CEST	192.168.2.4	1.1.1.1	0x495d	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:21:59.108062029 CEST	192.168.2.4	1.1.1.1	0xc540	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Sep 4, 2024 06:22:02.404618025 CEST	192.168.2.4	1.1.1.1	0xf473	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.406795979 CEST	192.168.2.4	1.1.1.1	0xab4a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 06:22:02.407510996 CEST	192.168.2.4	1.1.1.1	0xcaf	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.407650948 CEST	192.168.2.4	1.1.1.1	0x9512	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 06:22:02.408198118 CEST	192.168.2.4	1.1.1.1	0xd19	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.408476114 CEST	192.168.2.4	1.1.1.1	0x13c8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 06:22:02.409013987 CEST	192.168.2.4	1.1.1.1	0x3fd4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.413661003 CEST	192.168.2.4	1.1.1.1	0xc311	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 06:22:02.520998001 CEST	192.168.2.4	1.1.1.1	0x97a9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.521198034 CEST	192.168.2.4	1.1.1.1	0x3d6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 06:22:12.487715006 CEST	192.168.2.4	1.1.1.1	0x8697	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:12.488054991 CEST	192.168.2.4	1.1.1.1	0xbe7c	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Sep 4, 2024 06:22:16.050968885 CEST	192.168.2.4	1.1.1.1	0xe634	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:16.051481962 CEST	192.168.2.4	1.1.1.1	0x3687	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 06:22:16.052048922 CEST	192.168.2.4	1.1.1.1	0x61d4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:16.052181959 CEST	192.168.2.4	1.1.1.1	0xe90c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 06:22:16.117580891 CEST	192.168.2.4	1.1.1.1	0x5f95	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:16.117743969 CEST	192.168.2.4	1.1.1.1	0xa247	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 4, 2024 06:23:59.111323118 CEST	192.168.2.4	1.1.1.1	0x6c51	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:23:59.111468077 CEST	192.168.2.4	1.1.1.1	0xd3ce	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 4, 2024 06:21:59.114564896 CEST	1.1.1.1	192.168.2.4	0x495d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:21:59.114972115 CEST	1.1.1.1	192.168.2.4	0xc540	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:01.452358007 CEST	1.1.1.1	192.168.2.4	0xab88	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:01.452358007 CEST	1.1.1.1	192.168.2.4	0xab88	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.411874056 CEST	1.1.1.1	192.168.2.4	0xf473	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.411874056 CEST	1.1.1.1	192.168.2.4	0xf473	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.413927078 CEST	1.1.1.1	192.168.2.4	0xab4a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 06:22:02.414169073 CEST	1.1.1.1	192.168.2.4	0x9512	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 06:22:02.414377928 CEST	1.1.1.1	192.168.2.4	0xcaf	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.414377928 CEST	1.1.1.1	192.168.2.4	0xcaf	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.415081024 CEST	1.1.1.1	192.168.2.4	0xd19	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.415081024 CEST	1.1.1.1	192.168.2.4	0xd19	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.415242910 CEST	1.1.1.1	192.168.2.4	0x13c8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 06:22:02.415569067 CEST	1.1.1.1	192.168.2.4	0x3fd4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.415569067 CEST	1.1.1.1	192.168.2.4	0x3fd4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.420856953 CEST	1.1.1.1	192.168.2.4	0xc311	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 06:22:02.689527035 CEST	1.1.1.1	192.168.2.4	0x97a9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.689527035 CEST	1.1.1.1	192.168.2.4	0x97a9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:02.689618111 CEST	1.1.1.1	192.168.2.4	0x3d6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 06:22:12.494298935 CEST	1.1.1.1	192.168.2.4	0x8697	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:12.494298935 CEST	1.1.1.1	192.168.2.4	0x8697	No error (0)	googlehosted.l.googleusercontent.com		172.217.16.193	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:12.495748043 CEST	1.1.1.1	192.168.2.4	0xbe7c	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:12.546210051 CEST	1.1.1.1	192.168.2.4	0x8879	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:12.546210051 CEST	1.1.1.1	192.168.2.4	0x8879	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:14.065929890 CEST	1.1.1.1	192.168.2.4	0x8fa0	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:14.065929890 CEST	1.1.1.1	192.168.2.4	0x8fa0	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:14.065943003 CEST	1.1.1.1	192.168.2.4	0x15aa	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:15.076024055 CEST	1.1.1.1	192.168.2.4	0x8447	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:15.095832109 CEST	1.1.1.1	192.168.2.4	0xd75b	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:15.095832109 CEST	1.1.1.1	192.168.2.4	0xd75b	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:16.065264940 CEST	1.1.1.1	192.168.2.4	0x3687	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 06:22:16.065490007 CEST	1.1.1.1	192.168.2.4	0xe90c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 06:22:16.065500021 CEST	1.1.1.1	192.168.2.4	0x61d4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:16.065500021 CEST	1.1.1.1	192.168.2.4	0x61d4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:16.066416979 CEST	1.1.1.1	192.168.2.4	0xe634	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:16.066416979 CEST	1.1.1.1	192.168.2.4	0xe634	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:16.124466896 CEST	1.1.1.1	192.168.2.4	0xa247	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 4, 2024 06:22:16.124497890 CEST	1.1.1.1	192.168.2.4	0x5f95	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:16.124497890 CEST	1.1.1.1	192.168.2.4	0x5f95	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:17.109028101 CEST	1.1.1.1	192.168.2.4	0x6dfc	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:17.109028101 CEST	1.1.1.1	192.168.2.4	0x6dfc	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:18.675730944 CEST	1.1.1.1	192.168.2.4	0x6dfc	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:18.675730944 CEST	1.1.1.1	192.168.2.4	0x6dfc	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:20.336004972 CEST	1.1.1.1	192.168.2.4	0x1	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:20.336004972 CEST	1.1.1.1	192.168.2.4	0x1	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:20.336041927 CEST	1.1.1.1	192.168.2.4	0x1	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:20.336041927 CEST	1.1.1.1	192.168.2.4	0x1	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:22:20.336196899 CEST	1.1.1.1	192.168.2.4	0x1	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:22:20.336196899 CEST	1.1.1.1	192.168.2.4	0x1	No error (0)	sni1gl.wpc.nucdn.net		152.195.19.97	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:23:09.699960947 CEST	1.1.1.1	192.168.2.4	0x532e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:23:09.699960947 CEST	1.1.1.1	192.168.2.4	0x532e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:23:10.706221104 CEST	1.1.1.1	192.168.2.4	0x532e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:23:10.706221104 CEST	1.1.1.1	192.168.2.4	0x532e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:23:11.715238094 CEST	1.1.1.1	192.168.2.4	0x532e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:23:11.715238094 CEST	1.1.1.1	192.168.2.4	0x532e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:23:13.733539104 CEST	1.1.1.1	192.168.2.4	0x532e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:23:13.733539104 CEST	1.1.1.1	192.168.2.4	0x532e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:23:17.735397100 CEST	1.1.1.1	192.168.2.4	0x532e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 4, 2024 06:23:17.735397100 CEST	1.1.1.1	192.168.2.4	0x532e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:23:59.118088961 CEST	1.1.1.1	192.168.2.4	0x6c51	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:23:59.118088961 CEST	1.1.1.1	192.168.2.4	0x6c51	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 4, 2024 06:23:59.118110895 CEST	1.1.1.1	192.168.2.4	0xd3ce	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

clients2.googleusercontent.com

slscr.update.microsoft.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49747	13.107.246.60	443	1184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:02 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 04:22:02 UTC	552	IN	HTTP/1.1 200 OK Date: Wed, 04 Sep 2024 04:22:02 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 30 Aug 2024 17:05:10 GMT ETag: 0x8DCC915E7CD8385 x-ms-request-id: 1b6aa40f-801e-0039-70c1-fc28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240904T042202Z-16579567576rt7gkm43y59pk380000000a8000000000984t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-04 04:22:02 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49748	13.107.246.60	443	1184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:02 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 04:22:02 UTC	576	IN	HTTP/1.1 200 OK Date: Wed, 04 Sep 2024 04:22:02 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 3afe9785-e01e-0066-3464-fbda5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240904T042202Z-16579567576txfkctmnqv2e9c40000000a5g000000001dzu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-04 04:22:02 UTC	15808	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-09-04 04:22:02 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-09-04 04:22:02 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-09-04 04:22:02 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-09-04 04:22:02 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49753	172.64.41.3	443	1184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 04:22:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 04:22:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 04:22:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdb323c7846433d-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 04:22:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e5 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49751	172.64.41.3	443	1184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 04:22:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 04:22:02 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 04:22:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdb323c6e5d8c8d-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 04:22:02 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d5 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49752	172.64.41.3	443	1184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 04:22:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 04:22:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 04:22:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdb323c7bda0f90-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 04:22:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 02 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49754	162.159.61.3	443	1184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:02 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 04:22:02 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 04:22:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 04:22:02 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdb323cac377cf4-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 04:22:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 28 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49758	162.159.61.3	443	1184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 04:22:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 04:22:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 04:22:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdb323e6e847277-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 04:22:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0f 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49760	162.159.61.3	443	1184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:03 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 04:22:03 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 04:22:03 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 04:22:03 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdb32420b881849-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 04:22:03 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e7 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49759	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:03 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-04 04:22:04 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=217416 Date: Wed, 04 Sep 2024 04:22:04 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49763	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:04 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-04 04:22:05 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=217469 Date: Wed, 04 Sep 2024 04:22:05 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-04 04:22:05 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49764	142.251.40.238	443	1184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:04 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-04 04:22:05 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 04 Sep 2024 04:22:05 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49765	142.251.40.238	443	1184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:04 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-04 04:22:05 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 04 Sep 2024 04:22:05 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49766	142.250.81.228	443	1184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:05 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-04 04:22:05 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 04 Sep 2024 03:34:47 GMT Expires: Thu, 12 Sep 2024 03:34:47 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 2838 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-04 04:22:05 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-04 04:22:05 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-04 04:22:05 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-04 04:22:05 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-04 04:22:05 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49776	172.217.16.193	443	7460	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:13 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 04:22:13 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8ljvFkAfGD6T3x8T4YFrQfJobCyIDZeeGVWY9_EIjqMb4CRuA1Od_ViYDskpUy0UL2dPhkS4 X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Tue, 03 Sep 2024 19:26:09 GMT Expires: Wed, 03 Sep 2025 19:26:09 GMT Cache-Control: public, max-age=31536000 Age: 32164 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-04 04:22:13 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-09-04 04:22:13 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-09-04 04:22:13 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-09-04 04:22:13 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-09-04 04:22:13 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-09-04 04:22:13 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-09-04 04:22:13 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-09-04 04:22:13 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-09-04 04:22:13 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-09-04 04:22:13 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49777	13.107.246.60	443	7460	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:13 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 04:22:13 UTC	531	IN	HTTP/1.1 200 OK Date: Wed, 04 Sep 2024 04:22:13 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 30 Aug 2024 17:05:10 GMT ETag: 0x8DCC915E7CD8385 x-ms-request-id: 1b6aa40f-801e-0039-70c1-fc28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240904T042213Z-16579567576gnfmq2acf56mm700000000aag000000002p2n Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-04 04:22:13 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49775	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9P+O+nDG2XT7xAy&MD=9noKMRO1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-04 04:22:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 446a9842-47f2-49cc-95bb-f1aa352d7f2c MS-RequestId: c5c61c80-46bd-4401-bedd-d7515a8cb463 MS-CV: N1iiccJU3kmMyUuh.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 04 Sep 2024 04:22:14 GMT Connection: close Content-Length: 24490
2024-09-04 04:22:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-04 04:22:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49785	162.159.61.3	443	7460	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:16 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 04:22:16 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 04:22:16 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 04:22:16 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdb3291cdc48c05-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 04:22:16 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 11 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49786	172.64.41.3	443	7460	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:16 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 04:22:16 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 04:22:16 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 04:22:16 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdb3291dc3e5e78-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 04:22:16 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 29 00 04 8e fb 28 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49787	162.159.61.3	443	7460	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:16 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 04:22:16 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-04 04:22:16 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 04:22:16 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdb32922e641831-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 04:22:16 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 17 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	62564	152.195.19.97	443	7460	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:21 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726028533&P2=404&P3=2&P4=S22lvR2Xt81caCzPyKL1CzQJCzB2SUQje%2fS8M4QZsdmOKAXncuI8wmK92NEf4EYO%2fe4O71UyionoHoxAP6joLw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: gUXH1VAsEDKDcJLyF+DP9k Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 04:22:21 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5350272 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 04 Sep 2024 04:22:21 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-09-04 04:22:21 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	62565	162.159.61.3	443	7460	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:22 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-04 04:22:22 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom)QM
2024-09-04 04:22:22 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 04 Sep 2024 04:22:22 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bdb32b40e2717ed-EWR alt-svc: h3=":443"; ma=86400
2024-09-04 04:22:22 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 04 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 01 00 01 c0 0c 00 05 00 01 00 00 0e 05 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 30 00 05 00 01 00 00 00 31 00 02 c0 43 c0 43 00 01 00 01 00 00 00 31 00 04 0d 6b 15 ef c0 43 00 01 00 01 00 00 00 31 00 04 cc 4f c5 ef 00 00 29 04 d0 00 00 00 00 01 3e 00 0c 01 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcom-edge-microsoft-comdual-a-0036a-msedgenet01CC1kC1O)>:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	62571	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:22:52 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9P+O+nDG2XT7xAy&MD=9noKMRO1 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-04 04:22:52 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 4f6d760c-c4b2-45c5-9e85-5c4f6f73851b MS-RequestId: 9ae708fa-898c-4e4c-a0cf-4dc4a0e1ec12 MS-CV: lRxcKLm9HU2S9GrZ.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 04 Sep 2024 04:22:51 GMT Connection: close Content-Length: 30005
2024-09-04 04:22:52 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-04 04:22:52 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	62579	23.219.161.132	443	1184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-04 04:24:00 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-04 04:24:00 UTC	378	IN	HTTP/1.1 503 Service Unavailable Content-Length: 326 Content-Type: text/html; charset=us-ascii Date: Wed, 04 Sep 2024 04:24:00 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.84112317.1725423840.8e9342a Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-09-04 04:24:00 UTC	326	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><

Target ID:	0
Start time:	00:21:53
Start date:	04/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x920000
File size:	917'504 bytes
MD5 hash:	29602BD4C22F67125F6088E167B15765
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	00:21:53
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:21:54
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=2104,i,14732050079847253927,277997642366932063,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:21:54
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	00:21:55
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2928 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	00:21:59
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6376 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:21:59
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6316 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:22:00
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6744 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff646b50000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:22:00
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6744 --field-trial-handle=2196,i,14919740388162821288,17579235175626889489,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff646b50000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:22:09
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	00:22:09
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	00:22:09
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3488 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:22:11
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:8
Imagebase:	0x7ff646b50000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:22:11
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5996 --field-trial-handle=2284,i,927718151558713096,2537168901792685074,262144 /prefetch:8
Imagebase:	0x7ff646b50000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:22:17
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:22:17
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2052,i,2939389132138757947,6644282390956280002,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:22:25
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:22:25
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1460,i,14181872830460904141,6941328671088109176,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:22:38
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:22:38
Start date:	04/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=2020,i,12012237615067922076,315425196457050801,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.2%
Total number of Nodes:	1360
Total number of Limit Nodes:	34

Executed Functions

Function 0093F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0093F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0097F474
IsIconic.USER32(00000000), ref: 0097F47D
ShowWindow.USER32(00000000,00000009), ref: 0097F48A
SetForegroundWindow.USER32(00000000), ref: 0097F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0097F4AA
GetCurrentThreadId.KERNEL32 ref: 0097F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0097F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0097F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0097F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0097F4DE
SetForegroundWindow.USER32(00000000), ref: 0097F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0097F4F6
keybd_event.USER32(00000012,00000000), ref: 0097F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0097F50B
keybd_event.USER32(00000012,00000000), ref: 0097F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0097F519
keybd_event.USER32(00000012,00000000), ref: 0097F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0097F528
keybd_event.USER32(00000012,00000000), ref: 0097F52D
SetForegroundWindow.USER32(00000000), ref: 0097F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0097F557

Strings

Shell_TrayWnd, xrefs: 0097F46F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 558e694da279669ae80d21c6c3b2b62cc69d2e7d8e02f59d44b2582d5a49459d
Instruction ID: dbb9bf80a8d49cfde5c90ef4ce3e5792c7a7fab85f3f8985e05f6604ec3d55c0
Opcode Fuzzy Hash: 558e694da279669ae80d21c6c3b2b62cc69d2e7d8e02f59d44b2582d5a49459d
Instruction Fuzzy Hash: 3F3194B2A54218BBEB206BB58D4AFBF7E6CEB44B60F104125FA04F61D1C6B15D00BA60

Function 009242DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0092430D

Part of subcall function 00926B57: _wcslen.LIBCMT ref: 00926B6A

GetCurrentProcess.KERNEL32(?,009BCB64,00000000,?,?), ref: 00924422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00924429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00924454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00924466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00924474
FreeLibrary.KERNEL32(00000000,?,?), ref: 0092447B
GetSystemInfo.KERNEL32(?,?,?), ref: 009244A0

Strings

GetNativeSystemInfo, xrefs: 00924460
kernel32.dll, xrefs: 0092444F
|O, xrefs: 009636F8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: a25adb12f69711d9b5211ffcf30e118483ba903bbaaeb37ca8ae37f4b24fc118
Instruction ID: e6cb01cb7f2d5afbafbac080d2958a4554cbe0b57ce1a4c6e9d69f6dccfce1c3
Opcode Fuzzy Hash: a25adb12f69711d9b5211ffcf30e118483ba903bbaaeb37ca8ae37f4b24fc118
Instruction Fuzzy Hash: 83A1D37693E2D4DFCB11D77DBC411B97FE86B26300B088899E08193A36D2E54648FBE1

Function 009242A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,009250AA,?,?,00000000,00000000), ref: 009242B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,009250AA,?,?,00000000,00000000), ref: 009242C9
LoadResource.KERNEL32(?,00000000,?,?,009250AA,?,?,00000000,00000000,?,?,?,?,?,?,00924F20), ref: 009635BE
SizeofResource.KERNEL32(?,00000000,?,?,009250AA,?,?,00000000,00000000,?,?,?,?,?,?,00924F20), ref: 009635D3
LockResource.KERNEL32(009250AA,?,?,009250AA,?,?,00000000,00000000,?,?,?,?,?,?,00924F20,?), ref: 009635E6

Strings

SCRIPT, xrefs: 009242BF

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 4dd6193a9a8b66d58321cfad78ce19dfc114378c8a91a9b8725970e3916f904f
Instruction ID: 2b9671417aba25219aaf28c6b3f2e50185ac60a02a6da3f01d13ae00ae576d92
Opcode Fuzzy Hash: 4dd6193a9a8b66d58321cfad78ce19dfc114378c8a91a9b8725970e3916f904f
Instruction Fuzzy Hash: 10117CB0200710FFDB219B66ED48F677BBDEBC5B61F108269B42696254DB71DC009630

Function 00962BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00922B6B

Part of subcall function 00923A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,009F1418,?,00922E7F,?,?,?,00000000), ref: 00923A78

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,009E2224), ref: 00962C10
ShellExecuteW.SHELL32(00000000,?,?,009E2224), ref: 00962C17

Strings

runas, xrefs: 00962C0B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 5cb722d149bcf1abf1798261b143aa60498b233d4e7cc20b37e79401ba2f68a5
Instruction ID: b71f9f6b9d94eb72b8c379526469f8680ff0e4159d4244ed0f6be42f333db656
Opcode Fuzzy Hash: 5cb722d149bcf1abf1798261b143aa60498b233d4e7cc20b37e79401ba2f68a5
Instruction Fuzzy Hash: 8411D331608355AAC715FF70F851BBE77A8ABD6310F44482DF182560BACF258A49D792

Function 0098DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00965222), ref: 0098DBCE
GetFileAttributesW.KERNELBASE(?), ref: 0098DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0098DBEE
FindClose.KERNEL32(00000000), ref: 0098DBFA

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 30b59a24888b72db580cc982207c24c6dd59a5a990bafcfda872d8629340522a
Instruction ID: 5ff5f082b7d641847c28351a718b8471c5a32da08bfe4d8a454f03266d1ff71e
Opcode Fuzzy Hash: 30b59a24888b72db580cc982207c24c6dd59a5a990bafcfda872d8629340522a
Instruction Fuzzy Hash: D2F02B70829910578220BB7CEE0D8AA376C9E01334F104702F8B6C22F0EBB09D54D7D5

Function 009AAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 009AB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 009AB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 009AB1D4
_wcslen.LIBCMT ref: 009AB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 009AB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 009AB236
_wcslen.LIBCMT ref: 009AB332

Part of subcall function 009905A7: GetStdHandle.KERNEL32(000000F6), ref: 009905C6

_wcslen.LIBCMT ref: 009AB34B
_wcslen.LIBCMT ref: 009AB366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 009AB3B6
GetLastError.KERNEL32(00000000), ref: 009AB407
CloseHandle.KERNEL32(?), ref: 009AB439
CloseHandle.KERNEL32(00000000), ref: 009AB44A
CloseHandle.KERNEL32(00000000), ref: 009AB45C
CloseHandle.KERNEL32(00000000), ref: 009AB46E
CloseHandle.KERNEL32(?), ref: 009AB4E3

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 909a52c6bf9f666a5dda4d7dc88d3385d4640da3d041d1cfb7db266ad5e4e1f8
Instruction ID: a70d2cb9964848fad6ec3bd7c9d855d8126d4388b9ef22dc475ece963f6751cb
Opcode Fuzzy Hash: 909a52c6bf9f666a5dda4d7dc88d3385d4640da3d041d1cfb7db266ad5e4e1f8
Instruction Fuzzy Hash: 92F1B0315083509FCB14EF24C891B6EBBE5AFC6714F14895DF8999B2A6CB31EC40CB92

Function 0092D730 Relevance: 21.6, APIs: 14, Instructions: 619windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0092D807
timeGetTime.WINMM ref: 0092DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0092DB28
TranslateMessage.USER32(?), ref: 0092DB7B
DispatchMessageW.USER32(?), ref: 0092DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0092DB9F
Sleep.KERNELBASE(0000000A), ref: 0092DBB1

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: f22840a55e3360b764ca3d7fbe7fb932e5c05759c0e6d1120fb704f926325e9c
Instruction ID: 752cc1da9783fb998a15112aff0a7c11ffcc9573b2a085c949b62943338d2c98
Opcode Fuzzy Hash: f22840a55e3360b764ca3d7fbe7fb932e5c05759c0e6d1120fb704f926325e9c
Instruction Fuzzy Hash: B042237161A351DFD728CF24D894BAAB7E8BF86300F148A1DF49987291D774E884CF82

Function 00922CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00922D07
RegisterClassExW.USER32(00000030), ref: 00922D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00922D42
InitCommonControlsEx.COMCTL32(?), ref: 00922D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00922D6F
LoadIconW.USER32(000000A9), ref: 00922D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00922D94

Strings

+, xrefs: 00922CF0
TaskbarCreated, xrefs: 00922D37
0, xrefs: 00922CE9
AutoIt v3 GUI, xrefs: 00922D23

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 06b0880fda028be829b0b48cd1eb6698e2bb01a22f24f440de1d9fc449715e6f
Instruction ID: d628150dffbd674a9343b3d06ccdde1b65c4e0a9a0d3b32f5d2149eb5cd7e530
Opcode Fuzzy Hash: 06b0880fda028be829b0b48cd1eb6698e2bb01a22f24f440de1d9fc449715e6f
Instruction Fuzzy Hash: 4E21F4B5929308EFDB00DFA4ED89BEDBBB4FB08710F00421AF511A62A0D7B10540EF90

Function 0096065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0096039A: CreateFileW.KERNELBASE(00000000,00000000,?,00960704,?,?,00000000,?,00960704,00000000,0000000C), ref: 009603B7

GetLastError.KERNEL32 ref: 0096076F
__dosmaperr.LIBCMT ref: 00960776
GetFileType.KERNELBASE(00000000), ref: 00960782
GetLastError.KERNEL32 ref: 0096078C
__dosmaperr.LIBCMT ref: 00960795
CloseHandle.KERNEL32(00000000), ref: 009607B5
CloseHandle.KERNEL32(?), ref: 009608FF
GetLastError.KERNEL32 ref: 00960931
__dosmaperr.LIBCMT ref: 00960938

Strings

H, xrefs: 009608BD

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 375489d002ed8dd6f79b5288e8ec5633cd08fa9077229cf05d4d662996fe97ce
Instruction ID: 94db3f54f2fd3560fdc4d38dfcd0a0b3e2d36db54bb0d8164247c39986ffc3ef
Opcode Fuzzy Hash: 375489d002ed8dd6f79b5288e8ec5633cd08fa9077229cf05d4d662996fe97ce
Instruction Fuzzy Hash: 50A13532A141058FDF19EF68DC91BAE3BA4EB8A320F14025DF8159B3D2DB359D12DB91

Function 0092344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00923A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,009F1418,?,00922E7F,?,?,?,00000000), ref: 00923A78

Part of subcall function 00923357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00923379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0092356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0096318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 009631CE
RegCloseKey.ADVAPI32(?), ref: 00963210
_wcslen.LIBCMT ref: 00963277
_wcslen.LIBCMT ref: 00963286

Strings

\, xrefs: 0096328C
Include, xrefs: 00963184, 009631C5
\Include\, xrefs: 00923527
Software\AutoIt v3\AutoIt, xrefs: 00923560

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 12b4e8553a8d80ae21d6d2282847cd5a2dbfea80c81193eb7a5bacf6ccc9d935
Instruction ID: 6a5accb88ab9b6e027c5991c08356cf02ca6570509bd1e8d5ca9c1572d0b62d4
Opcode Fuzzy Hash: 12b4e8553a8d80ae21d6d2282847cd5a2dbfea80c81193eb7a5bacf6ccc9d935
Instruction Fuzzy Hash: F171D3B14183109FC314EF25EC91AABBBE8FFD5B50F40482EF44587160DB749A48DB62

Function 00922B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00922B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00922B9D
LoadIconW.USER32(00000063), ref: 00922BB3
LoadIconW.USER32(000000A4), ref: 00922BC5
LoadIconW.USER32(000000A2), ref: 00922BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00922BEF
RegisterClassExW.USER32(?), ref: 00922C40

Part of subcall function 00922CD4: GetSysColorBrush.USER32(0000000F), ref: 00922D07
Part of subcall function 00922CD4: RegisterClassExW.USER32(00000030), ref: 00922D31
Part of subcall function 00922CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00922D42
Part of subcall function 00922CD4: InitCommonControlsEx.COMCTL32(?), ref: 00922D5F
Part of subcall function 00922CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00922D6F
Part of subcall function 00922CD4: LoadIconW.USER32(000000A9), ref: 00922D85
Part of subcall function 00922CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00922D94

Strings

#, xrefs: 00922C16
0, xrefs: 00922C0F
AutoIt v3, xrefs: 00922C2F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 9f4f0891ae727720517f66f91e5c8b50470c2edd0331f6f5c2459eec2e503acf
Instruction ID: de87adf36124ac4a0bd3389d44fc64c9bb59c53a89c6b9b87e65c71e37f0b725
Opcode Fuzzy Hash: 9f4f0891ae727720517f66f91e5c8b50470c2edd0331f6f5c2459eec2e503acf
Instruction Fuzzy Hash: A9212CB0E28319EBDB109FA6ED95BA97FB4FB48B50F00415AF500A66A0D7F10544EFD0

Function 00923170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0092316A,?,?), ref: 009231D8
KillTimer.USER32(?,00000001,?,?,?,?,?,0092316A,?,?), ref: 00923204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00923227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0092316A,?,?), ref: 00923232
CreatePopupMenu.USER32 ref: 00923246
PostQuitMessage.USER32(00000000), ref: 00923267

Strings

TaskbarCreated, xrefs: 0092322D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 3c2d9d2f61d85dbbfb41c0b5f5efe789a74332e91309ec70fe089674da52a049
Instruction ID: 9914025eb1bd9fbd7d2a48d2d41336993ae93a4b2c778ddac64ef17daed72ed3
Opcode Fuzzy Hash: 3c2d9d2f61d85dbbfb41c0b5f5efe789a74332e91309ec70fe089674da52a049
Instruction Fuzzy Hash: AB417B3122C228E7DF242B78BD4DB79366DE745310F048125F551962E6CBBECA50E7E1

Function 00922C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00922C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00922CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00921CAD,?), ref: 00922CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00921CAD,?), ref: 00922CCF

Strings

AutoIt v3, xrefs: 00922C89, 00922C8E, 00922C8F
edit, xrefs: 00922CAC

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 0c80f7da92425d81d31b02bb84c9fbc69dc6589663c09695a0092d0d3a2b3921
Instruction ID: 9f137632acb0d2bf3f595b0d4bcd5cab05cd3efc8c7fde2f1661321b294349c9
Opcode Fuzzy Hash: 0c80f7da92425d81d31b02bb84c9fbc69dc6589663c09695a0092d0d3a2b3921
Instruction Fuzzy Hash: B5F0DAB6564294BAEB311717AC48EB72EBDD7C7F70B00005AF900A65A0C6A11850EAB0

Function 0098E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0098E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0098E9A5
Sleep.KERNEL32(00000000), ref: 0098E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0098E9B7
Sleep.KERNELBASE ref: 0098E9F3

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: e6151594ea96815ddbe3642c53bb0b863de16ea6d245620fabeca1aac30a2831
Instruction ID: 33017996d3af454d38c1cb41a970d22432995ba1261a6666f39059894a5482d8
Opcode Fuzzy Hash: e6151594ea96815ddbe3642c53bb0b863de16ea6d245620fabeca1aac30a2831
Instruction Fuzzy Hash: 89019E72C09A2DDBCF00AFE8DD69AEDBB78FF08311F000646E542B2240CB759550DBA1

Function 00923B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00923B0F,SwapMouseButtons,00000004,?), ref: 00923B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00923B0F,SwapMouseButtons,00000004,?), ref: 00923B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00923B0F,SwapMouseButtons,00000004,?), ref: 00923B83

Strings

Control Panel\Mouse, xrefs: 00923B3E

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 14f0c5b9b0b66f57c1c865e0189796253dbd5393e183d1501190b849dec91411
Instruction ID: 168e890f6c38383e20fb754312d4c0a67b60d76aa19ffc210b62eaba8c73ea65
Opcode Fuzzy Hash: 14f0c5b9b0b66f57c1c865e0189796253dbd5393e183d1501190b849dec91411
Instruction Fuzzy Hash: 0B112AB5521218FFDB208FA5EC44ABEB7BCEF05754B108959B805D7114D2359E40ABA0

Function 00923923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 009633A2

Part of subcall function 00926B57: _wcslen.LIBCMT ref: 00926B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00923A04

Strings

Line: , xrefs: 009633EB

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 2a209e869657474d45745eaf93b9f1ed0f7fbcb19015f022d6b10f8806638ee9
Instruction ID: f264f0f9870efbd03524104e424f4d8f8b0feffbeff60f1a6d209a98adbcadd9
Opcode Fuzzy Hash: 2a209e869657474d45745eaf93b9f1ed0f7fbcb19015f022d6b10f8806638ee9
Instruction Fuzzy Hash: A731F471518324EAC325EB20EC45FEBB3DCAF81714F00892AF59983195DBB49A48C7C2

Function 0093FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00940668

Part of subcall function 009432A4: RaiseException.KERNEL32(?,?,?,0094068A,?,009F1444,?,?,?,?,?,?,0094068A,00921129,009E8738,00921129), ref: 00943304

__CxxThrowException@8.LIBVCRUNTIME ref: 00940685

Strings

Unknown exception, xrefs: 00940692

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 4ae195b424875fdf20a8c6972350756b8ad8973b130a786d76fc08638ce401b5
Instruction ID: 640b3a9362bc7bef4c730c964f3b4b0500de9b31002da96bf7b53b6e3b298a72
Opcode Fuzzy Hash: 4ae195b424875fdf20a8c6972350756b8ad8973b130a786d76fc08638ce401b5
Instruction Fuzzy Hash: 15F0C23490030D778B00BAB5E85AE9E776C9EC0314B604671BA29969D2EF71DB25C980

Function 009210F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00921BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00921BF4
Part of subcall function 00921BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00921BFC
Part of subcall function 00921BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00921C07
Part of subcall function 00921BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00921C12
Part of subcall function 00921BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00921C1A
Part of subcall function 00921BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00921C22

Part of subcall function 00921B4A: RegisterWindowMessageW.USER32(00000004,?,009212C4), ref: 00921BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0092136A
OleInitialize.OLE32 ref: 00921388
CloseHandle.KERNEL32(00000000,00000000), ref: 009624AB

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: a2e07c92c4224e29c2e23fb349483093485127a56cbb6f6f27fbc3c1cef006e9
Instruction ID: 510f844896933298a44275f5fb6b697d9bb18572c85849225680b9dfda5718d6
Opcode Fuzzy Hash: a2e07c92c4224e29c2e23fb349483093485127a56cbb6f6f27fbc3c1cef006e9
Instruction Fuzzy Hash: F071ABB4929304CFC794EF7AAA456B53AE0BBD8394754822AE11ACB275EB314444EFC4

Function 0098C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00923923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00923A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0098C259
KillTimer.USER32(?,00000001,?,?), ref: 0098C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0098C270

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 1f02f03b39ea04e078b3de41c29987e0c8ba4cc6f4bfbfc40b60958923d2383d
Instruction ID: 24caf830a75f726c07fa3a1a2a9af8b7d83a06a57b54f66c5085eae72c7c8db3
Opcode Fuzzy Hash: 1f02f03b39ea04e078b3de41c29987e0c8ba4cc6f4bfbfc40b60958923d2383d
Instruction Fuzzy Hash: 933198B0904354AFEB72DF648895BE7BBEC9B06304F00449DD5EA97281C774AA84CB61

Function 009586AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,009585CC,?,009E8CC8,0000000C), ref: 00958704
GetLastError.KERNEL32(?,009585CC,?,009E8CC8,0000000C), ref: 0095870E
__dosmaperr.LIBCMT ref: 00958739

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 4ded7a4eed00948398b1ebddbe1324a1998cd81553fac93722674c0810d73748
Instruction ID: 812dfccc029214bb60496a7bbf80c920216c5dc08b9161b4f5df181e0754aa9a
Opcode Fuzzy Hash: 4ded7a4eed00948398b1ebddbe1324a1998cd81553fac93722674c0810d73748
Instruction Fuzzy Hash: A7014832A1A22056D364E236A849B7F2B4D4BC5776F2A0219FC18AB0D3DEB18C898350

Function 0092DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0092DB7B
DispatchMessageW.USER32(?), ref: 0092DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0092DB9F
Sleep.KERNELBASE(0000000A), ref: 0092DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00971CC9

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 0f89fe16a6bcacc7c0ea51df9a31c70546be9b43e7309841aa9379586973b776
Instruction ID: 065beea047fd29779b324484963fd81c6ab25ed7db74ab613dde1bc7ab579d7f
Opcode Fuzzy Hash: 0f89fe16a6bcacc7c0ea51df9a31c70546be9b43e7309841aa9379586973b776
Instruction Fuzzy Hash: 8EF058716193449BEB30CBA09D99FEA73ACEB84360F104A18E65AC30C0DB30A488DB65

Function 00931310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 009317F6

Strings

CALL, xrefs: 009317C6

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 86f95e9e04d417256e4fd13527046a829e120bb71e1f97c46ce2e95044d47e56
Instruction ID: b6e9ad50e24deb1dadb0a479af35f1a50e6eefa818bd52276e33ee541569f49b
Opcode Fuzzy Hash: 86f95e9e04d417256e4fd13527046a829e120bb71e1f97c46ce2e95044d47e56
Instruction Fuzzy Hash: 512289716082019FC714DF24C895B2ABBF5BF89314F28892DF49A8B3A1D735E945CF92

Function 00922DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00962C8C

Part of subcall function 00923AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00923A97,?,?,00922E7F,?,?,?,00000000), ref: 00923AC2

Part of subcall function 00922DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00922DC4

Strings

X, xrefs: 00962C5A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 9d8c83a0d6ece97dd7aa6f8e85d0300685909fb88a038cd6612668cef8657c89
Instruction ID: d9e1b7c4e1dac202d2b0e0773c37db40cd182475c542c5687c16f1c36e67d769
Opcode Fuzzy Hash: 9d8c83a0d6ece97dd7aa6f8e85d0300685909fb88a038cd6612668cef8657c89
Instruction Fuzzy Hash: AB21D870A102989FCF11EF94D845BEE7BFCAF98314F008059E405B7245DBB85A49CFA1

Function 00923837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00923908

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 8065f7e58ec01a92da0111b13c5c4b700c07158f2ac73d60dc4b24b68c553062
Instruction ID: 0361acc46937c753e43f725d3d747d262eeaadfa253544a1cc2d2e6e97e4ca89
Opcode Fuzzy Hash: 8065f7e58ec01a92da0111b13c5c4b700c07158f2ac73d60dc4b24b68c553062
Instruction Fuzzy Hash: A931A7B0504311DFD720DF25E884BA7B7E8FB49718F00092EF59987250D7B5AA44DB92

Function 0093F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0093F661

Part of subcall function 0092D730: GetInputState.USER32 ref: 0092D807

Sleep.KERNEL32(00000000), ref: 0097F2DE

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: de62105cac3c50445262b4b11cf61d7d26a6ff5be942d1c4140c8f7f2261a824
Instruction ID: 1ad3cc67fec9c1df6cde335265b3ac1abf355555c7b5ee42be7f2cddc98247b8
Opcode Fuzzy Hash: de62105cac3c50445262b4b11cf61d7d26a6ff5be942d1c4140c8f7f2261a824
Instruction Fuzzy Hash: 67F08C71244615AFD310EF69E559F6AB7E8FF85761F00412AF859DB261DB70A800CB90

Function 0092B710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0092BB4E

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 8af7928dfeee57cb17834855c7c7011150108ce486b9fb026f33ee3c71d19852
Instruction ID: 0beec0d6cd4e91b0d4c4ae2c4725ec1b0e5478476ba1f00ba9a4f79c747516a0
Opcode Fuzzy Hash: 8af7928dfeee57cb17834855c7c7011150108ce486b9fb026f33ee3c71d19852
Instruction Fuzzy Hash: 0832ED76A04229DFDB20CF14D894BBEB7F9EF84304F148059E919AB255C778AD81CB90

Function 009B2598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 009B2649

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 48033ccf2fa9340a42368a1aa5880863baa07ae7851c4dcf5ae91ae61d8642cb
Instruction ID: efb9d26d5e611ea726edd5d965e1b354af8b1836591d210d0062cfacc99e9ef4
Opcode Fuzzy Hash: 48033ccf2fa9340a42368a1aa5880863baa07ae7851c4dcf5ae91ae61d8642cb
Instruction Fuzzy Hash: 7321C274200619AFD720DF18C9D0EB6B799EB84378B24856DF8A68B392C771ED41CB90

Function 009B13B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 009B1420

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 3eb5a0a766310670cf91bbb120ebbb5162ad31904aa3464b6f6b8309ee67464c
Instruction ID: 0cc8d2c58f88fc44a5f2b11277676f920b9ccb689508250b20d2ccdeba947885
Opcode Fuzzy Hash: 3eb5a0a766310670cf91bbb120ebbb5162ad31904aa3464b6f6b8309ee67464c
Instruction Fuzzy Hash: 1E31E170204202AFC714EF29C5A5BA9F7A6FF84324F548168E8164B3A2DB31EC40CBD0

Function 00924ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00924E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00924EDD,?,009F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00924E9C
Part of subcall function 00924E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00924EAE
Part of subcall function 00924E90: FreeLibrary.KERNEL32(00000000,?,?,00924EDD,?,009F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00924EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,009F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00924EFD

Part of subcall function 00924E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00963CDE,?,009F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00924E62
Part of subcall function 00924E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00924E74
Part of subcall function 00924E59: FreeLibrary.KERNEL32(00000000,?,?,00963CDE,?,009F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00924E87

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: cdcb6aed9f6d6d621745815255b4c26a8807801649f189d11e488c4630ccf2c8
Instruction ID: 0a8f89f617e2980c938a7cf2fe9abe24e4789488ed7b4eb893c0e5d4eaa65ff5
Opcode Fuzzy Hash: cdcb6aed9f6d6d621745815255b4c26a8807801649f189d11e488c4630ccf2c8
Instruction Fuzzy Hash: E211E332610225AADF24AB64ED02FED77A5AFD0710F10842DF942A61C9EEB49E059B90

Function 00958402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00958440

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 797c9ef2df5591ad2981ce704ce688c0d441ccc8527d778a854edad7e5183c78
Instruction ID: c902d952dd00bf7f906c2966d3de318eb52bdc18ad7a4db6d1734ccda075c751
Opcode Fuzzy Hash: 797c9ef2df5591ad2981ce704ce688c0d441ccc8527d778a854edad7e5183c78
Instruction Fuzzy Hash: A711487190410AAFCF05DF59E941A9B7BF9EF48301F104059FC09AB312DA30DA15CBA4

Function 009B29BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,009B14B5,?), ref: 009B2A01

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 5a660ba6c3a0f62241bdeeb3d05602667d9f026b2f10865d07093975855c65fd
Instruction ID: a6d6d6026a9fddad73b0a49b8e1b69054df6d8d329549937140aa87c3bf54d70
Opcode Fuzzy Hash: 5a660ba6c3a0f62241bdeeb3d05602667d9f026b2f10865d07093975855c65fd
Instruction Fuzzy Hash: F101B136300A819FD324CB2DC754BA63796EBC9324F298568C04B8B291DB32FC42C7A0

Function 0094E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 99a5307f85835704cd127303fd66ef8200d6479d15b1293dceb823dc2ee7fa44
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: CEF02832511A1496C7317B7A9C09F9B339CAFD2336F110B15FC25A32D2CB74E80587A5

Function 009B149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 009B14EB

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 6054cef994348037b972ff490447994f40ab85c74171c53b7d9a17e829d4c974
Instruction ID: 999639549f0d066f7af4e101b79b4fea237c89979ffba3a9a19b614dd74229c2
Opcode Fuzzy Hash: 6054cef994348037b972ff490447994f40ab85c74171c53b7d9a17e829d4c974
Instruction Fuzzy Hash: 6F0147323043019FD320CF69C55096ABB96FF84334394805DE84A8B712D632DD82C7C0

Function 00953820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,009F1444,?,0093FDF5,?,?,0092A976,00000010,009F1440,009213FC,?,009213C6,?,00921129), ref: 00953852

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 71d7e89d34694dd44cf7913ed7d2f716d9cbaf1968691bb92105690ab0e04827
Instruction ID: 0df39195e37b7ce46602527114233a6d658f68a9fbd205927ad6e4655cd560e1
Opcode Fuzzy Hash: 71d7e89d34694dd44cf7913ed7d2f716d9cbaf1968691bb92105690ab0e04827
Instruction Fuzzy Hash: C9E02B31104224A7D73566779C00F9B375CAF827F2F058121FE15A3890CB51DD0583E0

Function 00924F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,009F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00924F6D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 6dafc069b68e82af8fe5e302094b240397801a197fe53a0522228252d94a83a1
Instruction ID: ec59e0424c8ced2d8fe2467047eeb3f322860762e35eb4b1e6adbe70a12b6a30
Opcode Fuzzy Hash: 6dafc069b68e82af8fe5e302094b240397801a197fe53a0522228252d94a83a1
Instruction Fuzzy Hash: CCF03071105761CFDB349F64E594852B7E4FF543293108D7EE1EA82515C7319844DF50

Function 009B2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 009B2A66

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 3df68c4c693675114c2be27955eed3c113a58efe47ca93235c333a35bd117e61
Instruction ID: bea2a0c4ed3ea4823af3a9bbb4882b0b9d6b9777ed5868a0b377d9557ee6f567
Opcode Fuzzy Hash: 3df68c4c693675114c2be27955eed3c113a58efe47ca93235c333a35bd117e61
Instruction Fuzzy Hash: 69E04F76354216AACB14EB30DD849FA775CEF903A57104536EC26C2240DB34999596A0

Function 00922DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00922DC4

Part of subcall function 00926B57: _wcslen.LIBCMT ref: 00926B6A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 24e4bd35f4415d690b5d0bc8313815f700715b3535b2808ad3d62940f557b1ff
Instruction ID: 7bb9bd3c0e878226075c7e0ec87b6e0701c67fe58529e83e778a8e0a504f73c5
Opcode Fuzzy Hash: 24e4bd35f4415d690b5d0bc8313815f700715b3535b2808ad3d62940f557b1ff
Instruction Fuzzy Hash: 7FE0CD726041245BC72092589C05FDA77DDDFC8790F040171FD09D7248DA60ED808550

Function 00922B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00923837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00923908

Part of subcall function 0092D730: GetInputState.USER32 ref: 0092D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00922B6B

Part of subcall function 009230F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0092314E

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: e1f2364818d1e4ca6ed591bb88db14a139d531d5eeb415c7dc24ba45a6c539df
Instruction ID: f6cf3deec2ffe39f647707c39839426e14d53b39263e0acb996a40e9f0df674d
Opcode Fuzzy Hash: e1f2364818d1e4ca6ed591bb88db14a139d531d5eeb415c7dc24ba45a6c539df
Instruction Fuzzy Hash: 4BE07D2130422803C704BB34B81277DB38DDBD1311F40453EF142831B7CF28454583E1

Function 00983D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00983D18

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: e0da4499616b9b7aaf4d8e2f41bc6996d246189619981f4f4ac1cea2b6a302b5
Instruction ID: f273dcbac99f0bbdb18c4b4bea863f305c8880c27519ef7e641e4d98c4c7fe0f
Opcode Fuzzy Hash: e0da4499616b9b7aaf4d8e2f41bc6996d246189619981f4f4ac1cea2b6a302b5
Instruction Fuzzy Hash: 54D08CF06A4308BEFB0083718D0BEBB339CC316E81F004BA57E02D64C1E9A0DE080130

Function 0096039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00960704,?,?,00000000,?,00960704,00000000,0000000C), ref: 009603B7

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a6b85c464930f4c4242fd33ec9eea2f6c2dd77eae12f544529168224ffdd956b
Instruction ID: 59f19a533fbc7c5c1e280715f609bf2339b722e844b32670091278adc1d0c62f
Opcode Fuzzy Hash: a6b85c464930f4c4242fd33ec9eea2f6c2dd77eae12f544529168224ffdd956b
Instruction Fuzzy Hash: DCD06C3205410DBBDF028F84DD06EDA3BAAFB48714F014100FE1866020C732E821AB90

Function 00921CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00921CBC

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: c15d45947c9f743922ffae7e8ce00ad2f139cb97577c9816a5ebee0cec749105
Instruction ID: 284bf7204441d8448e6a8ccd6d86137bd309b5a8710a23e2016acc530b5a8f5d
Opcode Fuzzy Hash: c15d45947c9f743922ffae7e8ce00ad2f139cb97577c9816a5ebee0cec749105
Instruction Fuzzy Hash: 8BC092362AC305EFF3248B80BD4AF207764A348B10F048001F609A96E3C3E22820FAA0

Non-executed Functions

Function 009B9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00939BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00939BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 009B961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 009B965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 009B969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 009B96C9
SendMessageW.USER32 ref: 009B96F2
GetKeyState.USER32(00000011), ref: 009B978B
GetKeyState.USER32(00000009), ref: 009B9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 009B97AE
GetKeyState.USER32(00000010), ref: 009B97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 009B97E9
SendMessageW.USER32 ref: 009B9810
SendMessageW.USER32(?,00001030,?,009B7E95), ref: 009B9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 009B992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 009B9941
SetCapture.USER32(?), ref: 009B994A
ClientToScreen.USER32(?,?), ref: 009B99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 009B99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 009B99D6
ReleaseCapture.USER32 ref: 009B99E1
GetCursorPos.USER32(?), ref: 009B9A19
ScreenToClient.USER32(?,?), ref: 009B9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 009B9A80
SendMessageW.USER32 ref: 009B9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 009B9AEB
SendMessageW.USER32 ref: 009B9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 009B9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 009B9B4A
GetCursorPos.USER32(?), ref: 009B9B68
ScreenToClient.USER32(?,?), ref: 009B9B75
GetParent.USER32(?), ref: 009B9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 009B9BFA
SendMessageW.USER32 ref: 009B9C2B
ClientToScreen.USER32(?,?), ref: 009B9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 009B9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 009B9CDE
SendMessageW.USER32 ref: 009B9D01
ClientToScreen.USER32(?,?), ref: 009B9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 009B9D82

Part of subcall function 00939944: GetWindowLongW.USER32(?,000000EB), ref: 00939952

GetWindowLongW.USER32(?,000000F0), ref: 009B9E05

Strings

@GUI_DRAGID, xrefs: 009B997D
F, xrefs: 009B9D07

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 55d5e87bca5193ac43a46a261b0dace4aa8b18bb0220002ae7ebb95cdf7d2743
Instruction ID: 6c7e6cf9e01449910adb23ac33e63befe8dfe458b8baa5f38b2888b1867d862c
Opcode Fuzzy Hash: 55d5e87bca5193ac43a46a261b0dace4aa8b18bb0220002ae7ebb95cdf7d2743
Instruction Fuzzy Hash: A4428E70228241EFD724CF24CE84FAABBE9FF89324F104619F699872A1D771D850DB91

Function 009B4873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 009B48F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 009B4908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 009B4927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 009B494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 009B495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 009B497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 009B49AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 009B49D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 009B4A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 009B4A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 009B4A7E
IsMenu.USER32(?), ref: 009B4A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 009B4AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 009B4B20
GetWindowLongW.USER32(?,000000F0), ref: 009B4B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 009B4BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 009B4C82
wsprintfW.USER32 ref: 009B4CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 009B4CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 009B4CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 009B4D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 009B4D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 009B4D5A

Strings

%d/%02d/%02d, xrefs: 009B4CA8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: b9808f63a5ec04113ea3d09a61dbf7a82b0191ca1926aac76299322a73c4a2a4
Instruction ID: 868e0a11a30289dc17c89252eb0c3a1d1e3f08f101716b00153a8a2083e016cd
Opcode Fuzzy Hash: b9808f63a5ec04113ea3d09a61dbf7a82b0191ca1926aac76299322a73c4a2a4
Instruction Fuzzy Hash: 3612EF71600215ABEB258F24CE49FEE7BF8EF85720F104629F515EB2E2DB749940EB50

Function 00981201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 009816C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0098170D
Part of subcall function 009816C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0098173A
Part of subcall function 009816C3: GetLastError.KERNEL32 ref: 0098174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00981286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 009812A8
CloseHandle.KERNEL32(?), ref: 009812B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 009812D1
GetProcessWindowStation.USER32 ref: 009812EA
SetProcessWindowStation.USER32(00000000), ref: 009812F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00981310

Part of subcall function 009810BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,009811FC), ref: 009810D4
Part of subcall function 009810BF: CloseHandle.KERNEL32(?,?,009811FC), ref: 009810E9

Strings

default, xrefs: 0098130B
winsta0, xrefs: 009812CC
, xrefs: 0098125A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 62d7baaeb3d72b8acda12bbb7eb70a58b815c7678bb4d7cb6c325694488721ee
Instruction ID: 113eacf8e3be2f92c685b81a583fab536b0b30ae29bb367fba7126fddd5bd955
Opcode Fuzzy Hash: 62d7baaeb3d72b8acda12bbb7eb70a58b815c7678bb4d7cb6c325694488721ee
Instruction Fuzzy Hash: C981ABB1900209AFDF21AFA4DD49FEE7BBDEF44704F144229FA11E62A0D7358946DB24

Function 00980B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009810F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00981114
Part of subcall function 009810F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00980B9B,?,?,?), ref: 00981120
Part of subcall function 009810F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00980B9B,?,?,?), ref: 0098112F
Part of subcall function 009810F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00980B9B,?,?,?), ref: 00981136
Part of subcall function 009810F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0098114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00980BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00980C00
GetLengthSid.ADVAPI32(?), ref: 00980C17
GetAce.ADVAPI32(?,00000000,?), ref: 00980C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00980C6D
GetLengthSid.ADVAPI32(?), ref: 00980C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00980C8C
HeapAlloc.KERNEL32(00000000), ref: 00980C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00980CB4
CopySid.ADVAPI32(00000000), ref: 00980CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00980CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00980D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00980D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00980D45
HeapFree.KERNEL32(00000000), ref: 00980D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00980D55
HeapFree.KERNEL32(00000000), ref: 00980D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00980D65
HeapFree.KERNEL32(00000000), ref: 00980D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00980D78
HeapFree.KERNEL32(00000000), ref: 00980D7F

Part of subcall function 00981193: GetProcessHeap.KERNEL32(00000008,00980BB1,?,00000000,?,00980BB1,?), ref: 009811A1
Part of subcall function 00981193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00980BB1,?), ref: 009811A8
Part of subcall function 00981193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00980BB1,?), ref: 009811B7

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: dc07df70a742f4d8188d54f8af231fffa072e05645150657368072ae5d8b494c
Instruction ID: 83671cfd1eb8e4f569da89c248bed6b5eb95ef416f91443f9819bc94e030be8d
Opcode Fuzzy Hash: dc07df70a742f4d8188d54f8af231fffa072e05645150657368072ae5d8b494c
Instruction Fuzzy Hash: CE716BB290420AAFDF50EFA4DD45FAEBBBCBF44310F044619F914A7291D771A909CB60

Function 0099EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(009BCC08), ref: 0099EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0099EB37
GetClipboardData.USER32(0000000D), ref: 0099EB43
CloseClipboard.USER32 ref: 0099EB4F
GlobalLock.KERNEL32(00000000), ref: 0099EB87
CloseClipboard.USER32 ref: 0099EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 0099EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0099EBC9
GetClipboardData.USER32(00000001), ref: 0099EBD1
GlobalLock.KERNEL32(00000000), ref: 0099EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 0099EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0099EC38
GetClipboardData.USER32(0000000F), ref: 0099EC44
GlobalLock.KERNEL32(00000000), ref: 0099EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0099EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0099EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0099ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 0099ECF3
CountClipboardFormats.USER32 ref: 0099ED14
CloseClipboard.USER32 ref: 0099ED59

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 9ca6ff4c22aca6e0880905a7e84f346ed4f9f554846006611534c710cc11cc11
Instruction ID: 3dfabdb5df3bc979df3cd84174ed03aa50d8d93e31eec154d50949427dee6454
Opcode Fuzzy Hash: 9ca6ff4c22aca6e0880905a7e84f346ed4f9f554846006611534c710cc11cc11
Instruction Fuzzy Hash: 0961D075208202AFD700EF28D985F2A77E8FF84724F18461DF496972A2DB31DD45DBA2

Function 0099698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 009969BE
FindClose.KERNEL32(00000000), ref: 00996A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00996A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00996A75

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00996AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00996ADF

Strings

%4d%02d%02d%02d%02d%02d%03d, xrefs: 00996B32
%02d, xrefs: 00996C00, 00996C0A, 00996C5A, 00996CAA, 00996CFA, 00996D4A
%4d%02d%02d%02d%02d%02d, xrefs: 00996B6A
%4d, xrefs: 00996BB1
%03d, xrefs: 00996DA2

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 10d82b33ccf5baaadb37ea025d8df57c575c5d6d41a896e4cfdbed18e294af60
Instruction ID: 8ba1e852dedf79d1f039db96c1d4d7ed4bf65fcf9cc530f6868254844170d54c
Opcode Fuzzy Hash: 10d82b33ccf5baaadb37ea025d8df57c575c5d6d41a896e4cfdbed18e294af60
Instruction Fuzzy Hash: 63D15FB2508310AEC710EBA4D991EAFB7ECAFD8704F44491DF589D6191EB34DA04CBA2

Function 00999642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00999663
GetFileAttributesW.KERNEL32(?), ref: 009996A1
SetFileAttributesW.KERNEL32(?,?), ref: 009996BB
FindNextFileW.KERNEL32(00000000,?), ref: 009996D3
FindClose.KERNEL32(00000000), ref: 009996DE
FindFirstFileW.KERNEL32(*.*,?), ref: 009996FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0099974A
SetCurrentDirectoryW.KERNEL32(009E6B7C), ref: 00999768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00999772
FindClose.KERNEL32(00000000), ref: 0099977F
FindClose.KERNEL32(00000000), ref: 0099978F

Strings

*.*, xrefs: 009996F5

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 48a0b6a5742c3adc0f1d6f5744cec64a58cb302b818db63e92630f7f12170461
Instruction ID: c3d86f4ff15bd4b438ed2d22feba9fd14c80c38b282a6e67fcc069e92b2bb3e3
Opcode Fuzzy Hash: 48a0b6a5742c3adc0f1d6f5744cec64a58cb302b818db63e92630f7f12170461
Instruction Fuzzy Hash: 4331CE725042196BDF14AFFDDD48ADE77ACAF89320F14426AF815E21A0EB71DE408A20

Function 0099979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 009997BE
FindNextFileW.KERNEL32(00000000,?), ref: 00999819
FindClose.KERNEL32(00000000), ref: 00999824
FindFirstFileW.KERNEL32(*.*,?), ref: 00999840
SetCurrentDirectoryW.KERNEL32(?), ref: 00999890
SetCurrentDirectoryW.KERNEL32(009E6B7C), ref: 009998AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 009998B8
FindClose.KERNEL32(00000000), ref: 009998C5
FindClose.KERNEL32(00000000), ref: 009998D5

Part of subcall function 0098DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0098DB00

Strings

*.*, xrefs: 0099983B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 309e316870e6c8e54722c667a65892b853f0c7e737680a6d2d4b451574db10d8
Instruction ID: e0291823480371b8f7ccd941ba16e7c479805f10c74c36fc6b287292c8d9704a
Opcode Fuzzy Hash: 309e316870e6c8e54722c667a65892b853f0c7e737680a6d2d4b451574db10d8
Instruction Fuzzy Hash: 0D31C1715042196FDF20AFBEEC48ADE77AC9F46334F14426EE854A2191EB71DE848B20

Function 009ABE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009AC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,009AB6AE,?,?), ref: 009AC9B5
Part of subcall function 009AC998: _wcslen.LIBCMT ref: 009AC9F1
Part of subcall function 009AC998: _wcslen.LIBCMT ref: 009ACA68
Part of subcall function 009AC998: _wcslen.LIBCMT ref: 009ACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009ABF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 009ABFA9
RegCloseKey.ADVAPI32(00000000), ref: 009ABFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 009AC02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 009AC0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 009AC154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 009AC1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 009AC23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 009AC2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 009AC382
RegCloseKey.ADVAPI32(00000000), ref: 009AC38F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: d0600b90e2217cc06ee1581d24be500dca9dfcceb6660a0abecc553c32a7cbe0
Instruction ID: 11bb481d3a6efb6bc5dad8fc550650d0691195bc8642e0c1be24d8eb56302f8b
Opcode Fuzzy Hash: d0600b90e2217cc06ee1581d24be500dca9dfcceb6660a0abecc553c32a7cbe0
Instruction Fuzzy Hash: B4024EB16042109FDB14DF24C895E2ABBE5EF89314F18849DF849DF2A2DB31ED45CB91

Function 00998195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00998257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00998267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00998273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00998310
SetCurrentDirectoryW.KERNEL32(?), ref: 00998324
SetCurrentDirectoryW.KERNEL32(?), ref: 00998356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0099838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00998395

Strings

*.*, xrefs: 0099839B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 1c85dafcfded46f69e12a5d033c7bda9f662163da1f3e3f7f6912b77e3051d4b
Instruction ID: 59a4990f414708afd347eac6c9d09729e61ffab6d97c7832c8704f94420d5d0d
Opcode Fuzzy Hash: 1c85dafcfded46f69e12a5d033c7bda9f662163da1f3e3f7f6912b77e3051d4b
Instruction Fuzzy Hash: DB615AB25083059FCB10EF64D841AAFB3E8FF89314F04892EF99997251DB35E945CB92

Function 0098D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00923AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00923A97,?,?,00922E7F,?,?,?,00000000), ref: 00923AC2

Part of subcall function 0098E199: GetFileAttributesW.KERNEL32(?,0098CF95), ref: 0098E19A

FindFirstFileW.KERNEL32(?,?), ref: 0098D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0098D1DD
MoveFileW.KERNEL32(?,?), ref: 0098D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0098D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0098D237

Part of subcall function 0098D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0098D21C,?,?), ref: 0098D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0098D253
FindClose.KERNEL32(00000000), ref: 0098D264

Strings

\*.*, xrefs: 0098D0CD, 0098D0D6, 0098D0EB

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: f12ebedc3dd3784b8d0304d718748e27d28ab14fe1736938a7fbc2616a45c6d4
Instruction ID: 8c59b86c499cbeb0b578bd96231748c8eb27fc240e5e2e092d550c03a84f077b
Opcode Fuzzy Hash: f12ebedc3dd3784b8d0304d718748e27d28ab14fe1736938a7fbc2616a45c6d4
Instruction Fuzzy Hash: 49618C7180611DAFCF05FBE0DA92AEDB7B9AF94300F244165E41277295EB34AF09CB60

Function 0099ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0099ED91
EmptyClipboard.USER32 ref: 0099ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0099EDAC
CloseClipboard.USER32 ref: 0099EEA3

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 0264ec36fe41df9d141d15854a36539ae70052d96ccd789da2cdcb9a3f0a7b0f
Instruction ID: 8af158434b2ba397b3d730319138e2559eaadbf546b8ed614373392f03696c58
Opcode Fuzzy Hash: 0264ec36fe41df9d141d15854a36539ae70052d96ccd789da2cdcb9a3f0a7b0f
Instruction Fuzzy Hash: 5041CF71618612EFEB10CF59E988F19BBE5FF44328F14C599E4168B6A2C735EC41CB90

Function 0098E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 009816C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0098170D
Part of subcall function 009816C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0098173A
Part of subcall function 009816C3: GetLastError.KERNEL32 ref: 0098174A

ExitWindowsEx.USER32(?,00000000), ref: 0098E932

Strings

SeShutdownPrivilege, xrefs: 0098E902
, xrefs: 0098E95C
, xrefs: 0098E920
@, xrefs: 0098E925

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 33a4a9c1b3b44b75c9962c05a20ecb52067ed9f964f7f7fe2cc9822251ba443c
Instruction ID: 5fa12e54936660d4c95d99398a648c1f6b9478653cf3ddd1fb1fa41d9cbfeba5
Opcode Fuzzy Hash: 33a4a9c1b3b44b75c9962c05a20ecb52067ed9f964f7f7fe2cc9822251ba443c
Instruction Fuzzy Hash: 7101F972624211ABEB6436B49C96FBF725C97147A0F154921FC13E33E2D6E69C4093A0

Function 009A1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 009A1276
WSAGetLastError.WSOCK32 ref: 009A1283
bind.WSOCK32(00000000,?,00000010), ref: 009A12BA
WSAGetLastError.WSOCK32 ref: 009A12C5
closesocket.WSOCK32(00000000), ref: 009A12F4
listen.WSOCK32(00000000,00000005), ref: 009A1303
WSAGetLastError.WSOCK32 ref: 009A130D
closesocket.WSOCK32(00000000), ref: 009A133C

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 51e5ac094a51f648400d2f562527fcc721aa4169e8fd5c54006d49d90d72868d
Instruction ID: 05dee9aa1b282abf3853f591e55a9041a3989062e0f332f98e3c6122fb0e078e
Opcode Fuzzy Hash: 51e5ac094a51f648400d2f562527fcc721aa4169e8fd5c54006d49d90d72868d
Instruction Fuzzy Hash: 4B419271A001109FD710DF64D588B6ABBE5BF86328F188198E8669F2D6C771ED81CBE1

Function 0098D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00923AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00923A97,?,?,00922E7F,?,?,?,00000000), ref: 00923AC2

Part of subcall function 0098E199: GetFileAttributesW.KERNEL32(?,0098CF95), ref: 0098E19A

FindFirstFileW.KERNEL32(?,?), ref: 0098D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0098D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0098D481
FindClose.KERNEL32(00000000), ref: 0098D498
FindClose.KERNEL32(00000000), ref: 0098D4A1

Strings

\*.*, xrefs: 0098D3F2

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 061062289f5b8fa2fe4a8475e7bf3c36f45a675084296876b1f9b8f01cd79e12
Instruction ID: c81bf0a4b6582c59e64f3eb3252ef02559b8d63a8bbc241a555dd27c03d6ebd3
Opcode Fuzzy Hash: 061062289f5b8fa2fe4a8475e7bf3c36f45a675084296876b1f9b8f01cd79e12
Instruction Fuzzy Hash: 3E316D7101D3559FC204FF64D8919AFB7A8BED1314F444A2DF4D1922E1EB34EA099B62

Function 0095E4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0095E645

Strings

1#INF, xrefs: 0095F852
1#SNAN, xrefs: 0095F844
1#QNAN, xrefs: 0095F84B
1#IND, xrefs: 0095F83D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 6680fdb5b0071ddc855cb0e0af7af30c5a3cf89604c85a4dd92af5cf1f00fafe
Instruction ID: 2697487731da0e0e5e2d109aec87b320b0bd993aadb0548328e58f19d99c0812
Opcode Fuzzy Hash: 6680fdb5b0071ddc855cb0e0af7af30c5a3cf89604c85a4dd92af5cf1f00fafe
Instruction Fuzzy Hash: 15C28F71D086288FDB29CF29CD507EAB3B9EB44316F1445EAD84DE7240E779AE858F40

Function 0099648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009964DC
CoInitialize.OLE32(00000000), ref: 00996639
CoCreateInstance.OLE32(009BFCF8,00000000,00000001,009BFB68,?), ref: 00996650
CoUninitialize.OLE32 ref: 009968D4

Strings

.lnk, xrefs: 009964BA, 00996524, 009965E0

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 1af3b0fc89a3da6141f5f696228b40382754d078778be07bec5b05aaff2a02a8
Instruction ID: a44d95bbf5f6df8a6bd7280c7d38d4118b1a817a9b2e7afecbd1e0a90b66961a
Opcode Fuzzy Hash: 1af3b0fc89a3da6141f5f696228b40382754d078778be07bec5b05aaff2a02a8
Instruction Fuzzy Hash: 62D13671508211AFC704EF24D891EABB7E8BFD8704F04496DF5958B2A5EB70ED09CB92

Function 009A22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 009A22E8

Part of subcall function 0099E4EC: GetWindowRect.USER32(?,?), ref: 0099E504

GetDesktopWindow.USER32 ref: 009A2312
GetWindowRect.USER32(00000000), ref: 009A2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 009A2355
GetCursorPos.USER32(?), ref: 009A2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 009A23DF

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 522211f77c7365b7c8f8721539a3d326548d1bc61381def36bec718558cf75dd
Instruction ID: 92e2bd9b53d0abcca926d36db2ebd1e506254274c648f45fb3618764142ebcd6
Opcode Fuzzy Hash: 522211f77c7365b7c8f8721539a3d326548d1bc61381def36bec718558cf75dd
Instruction Fuzzy Hash: 9331D072508315AFCB20DF18C849F5BB7A9FF86710F000A19F98597191DB74E908CBD2

Function 00999B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00999B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00999C8B

Part of subcall function 00993874: GetInputState.USER32 ref: 009938CB
Part of subcall function 00993874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00993966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00999BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00999C75

Strings

*.*, xrefs: 00999B5D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: f7e250a739496def882959d330d79501709e0ff2052b64bff3934b3807a79243
Instruction ID: eaaa3c8afe1fa32d05fcb2dfe8f2caafad8751b8e814347e48719020e4436b7e
Opcode Fuzzy Hash: f7e250a739496def882959d330d79501709e0ff2052b64bff3934b3807a79243
Instruction Fuzzy Hash: 7441927190420A9FDF14DFACDD45BEEBBB8EF55310F14415AE449A2191EB309E44CF60

Function 0093997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00939BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00939BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00939A4E
GetSysColor.USER32(0000000F), ref: 00939B23
SetBkColor.GDI32(?,00000000), ref: 00939B36

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 8481ca55114685e34f8f01f5b9a1082b28cccc839cfc8defe05f6e75cc1034fe
Instruction ID: 0248bf53428792e6ad2df8c93c630ed36cda6d99da1a0a5c11df1e92a7a206fd
Opcode Fuzzy Hash: 8481ca55114685e34f8f01f5b9a1082b28cccc839cfc8defe05f6e75cc1034fe
Instruction Fuzzy Hash: BEA18E7211C404FEE7289B7D8D99FBB769DDB82350F104709F102C6695CAA9DD01DBB2

Function 009A1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009A304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 009A307A
Part of subcall function 009A304E: _wcslen.LIBCMT ref: 009A309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 009A185D
WSAGetLastError.WSOCK32 ref: 009A1884
bind.WSOCK32(00000000,?,00000010), ref: 009A18DB
WSAGetLastError.WSOCK32 ref: 009A18E6
closesocket.WSOCK32(00000000), ref: 009A1915

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 2b01adad76f237baaa023e6d44509a254958cdd8db13d44f9e958a3f3bf6d414
Instruction ID: 92d35cdefc35222eb3bdef9112c5370430291155cb839e818cc78534fe919da9
Opcode Fuzzy Hash: 2b01adad76f237baaa023e6d44509a254958cdd8db13d44f9e958a3f3bf6d414
Instruction Fuzzy Hash: C751B271A00210AFDB10AF24D886F6AB7E9AB89718F048458F905AF3D7D775AD41CBE1

Function 009B1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 009B1CC0
IsWindowEnabled.USER32 ref: 009B1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 009B1CDB
IsIconic.USER32 ref: 009B1CE9
IsZoomed.USER32 ref: 009B1CF7

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 53c119e5edbe091c843eb023e93751842ef2411461ec96cf2f82c9415e3d4591
Instruction ID: 3fd8573687cde74930bc39c7f2f6a11c03d74740a7d121d38d239ee5ce43f985
Opcode Fuzzy Hash: 53c119e5edbe091c843eb023e93751842ef2411461ec96cf2f82c9415e3d4591
Instruction Fuzzy Hash: 8021A3717442119FD7208F1AD9A4BAA7FA9EF85334F598058E88ACB351CB71ED42CB90

Function 00928060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00965DF0
ERCP, xrefs: 0092813C
VUUU, xrefs: 0092843C
VUUU, xrefs: 009283E8
VUUU, xrefs: 009283FA

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: a5a343f0e739801cbeb8b3f4b02f77383760ac8249bf9a696e39b52342ebbee1
Instruction ID: 42590ef24626f4079fc3bd60b81e468284088fa3664685156a3f71606664b647
Opcode Fuzzy Hash: a5a343f0e739801cbeb8b3f4b02f77383760ac8249bf9a696e39b52342ebbee1
Instruction Fuzzy Hash: 98A2A070E0122ACBDF24CF58D8507AEB7B5BF54310F2585AAE815A7389EB749D81CF90

Function 009AA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 009AA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 009AA6BA

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

Process32NextW.KERNEL32(00000000,?), ref: 009AA79C
CloseHandle.KERNEL32(00000000), ref: 009AA7AB

Part of subcall function 0093CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00963303,?), ref: 0093CE8A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: ffcc97dfe1958ab209a80a2a84827dcf588f97cb2f496a2d1ed2bdbc54fea9f7
Instruction ID: 1e7c101b2acd4a43c7926ecc26cbc5b9dbc600b05ece46e5500399cc65a70523
Opcode Fuzzy Hash: ffcc97dfe1958ab209a80a2a84827dcf588f97cb2f496a2d1ed2bdbc54fea9f7
Instruction Fuzzy Hash: 48511BB1508310AFD714EF24D886A6BBBE8FFC9754F40492DF59597261EB30E904CB92

Function 0098AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0098AAAC
SetKeyboardState.USER32(00000080), ref: 0098AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0098AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0098AB88

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 8e2c2933f2fa4270e6254b0e7c76d5cc8232484d08ff18a481880d3f7b76b465
Instruction ID: 0c7420b6c893f17adef0c3bfd23fcc235dc6cec437a7dba7662405e5340f3818
Opcode Fuzzy Hash: 8e2c2933f2fa4270e6254b0e7c76d5cc8232484d08ff18a481880d3f7b76b465
Instruction Fuzzy Hash: 6A312870A40208AEFF35EB65CC05BFA7BAAAB54320F08421BF081967D1D3798981D762

Function 0095BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0095BB7F

Part of subcall function 009529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0095D7D1,00000000,00000000,00000000,00000000,?,0095D7F8,00000000,00000007,00000000,?,0095DBF5,00000000), ref: 009529DE
Part of subcall function 009529C8: GetLastError.KERNEL32(00000000,?,0095D7D1,00000000,00000000,00000000,00000000,?,0095D7F8,00000000,00000007,00000000,?,0095DBF5,00000000,00000000), ref: 009529F0

GetTimeZoneInformation.KERNEL32 ref: 0095BB91
WideCharToMultiByte.KERNEL32(00000000,?,009F121C,000000FF,?,0000003F,?,?), ref: 0095BC09
WideCharToMultiByte.KERNEL32(00000000,?,009F1270,000000FF,?,0000003F,?,?,?,009F121C,000000FF,?,0000003F,?,?), ref: 0095BC36

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 3f455158045d2bec0ccc296a4841f780bb8b8a5e0911ba18888f8f7b342fcb6b
Instruction ID: c7a82c0ca0f5f437634e7081d3fadf0d156812629bc53dd8dc5c4ee926b46ca9
Opcode Fuzzy Hash: 3f455158045d2bec0ccc296a4841f780bb8b8a5e0911ba18888f8f7b342fcb6b
Instruction Fuzzy Hash: D631D570908205DFCB15DFAADC809BDBBB8FF45311B14466AE860E72B1D7309D44DB90

Function 0099CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0099CE89
GetLastError.KERNEL32(?,00000000), ref: 0099CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0099CEFE

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 860f37d076884630796c95d877c7a2981e83cf0b41d0c714d44e8ae5fec0a6ea
Instruction ID: 0c96c56be3568755a41aaa1e7cbf189fc6233ff15d544705e0327bb62db23bcc
Opcode Fuzzy Hash: 860f37d076884630796c95d877c7a2981e83cf0b41d0c714d44e8ae5fec0a6ea
Instruction Fuzzy Hash: 72219AB1504705ABEF20DFA9CD88BA6B7FCEB50358F10482EE546D2151E774EE049B64

Function 00988298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 009882AA

Strings

(, xrefs: 009882F0
|, xrefs: 009882DA

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: a8c10f330e84dc9c0e30081414961c8b259ebefdfbe2e9b4bac61be6b843f3a7
Instruction ID: 012bdb5b7974c6f317971dd4c116cfd62c2f60d063caef427a3dde3a4bc816ff
Opcode Fuzzy Hash: a8c10f330e84dc9c0e30081414961c8b259ebefdfbe2e9b4bac61be6b843f3a7
Instruction Fuzzy Hash: 94323475A007059FCB28DF69C480A6AB7F0FF48710B55C56EE49ADB3A1EB70E981CB50

Function 00995C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00995CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00995D17
FindClose.KERNEL32(?), ref: 00995D5F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 1aabf68620e617364cbbe956b874a748c3dc52ef7abfb31e0bec0da215dc9469
Instruction ID: 3dc07e6a4c6b4afc8bfdd107c0696b0b7f7726c1a7821d1cd6fc1b49aa8c97c4
Opcode Fuzzy Hash: 1aabf68620e617364cbbe956b874a748c3dc52ef7abfb31e0bec0da215dc9469
Instruction Fuzzy Hash: DD51BC746046019FCB14CF28D494E9AB7E8FF49324F15855DE99A8B3A1CB30EC04CF91

Function 00952622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0095271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00952724
UnhandledExceptionFilter.KERNEL32(?), ref: 00952731

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f8a328dc4908e529d8051e839fe2541f1ddd7380f99bc17d1a04154e3a3e6047
Instruction ID: 3ba851c38353e895c67e84b0e2071215fdb7419cd09e8f6b1c4d258d600037e3
Opcode Fuzzy Hash: f8a328dc4908e529d8051e839fe2541f1ddd7380f99bc17d1a04154e3a3e6047
Instruction Fuzzy Hash: 4131D5749112189BCB21DF64DD89B9CB7B8BF48310F5042EAE81CA7261E7309F858F45

Function 009951CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 009951DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00995238
SetErrorMode.KERNEL32(00000000), ref: 009952A1

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 18c12dbcc743baeea212ecce8a66d39814213ff7824e53a94a812b0ef6bbb1c2
Instruction ID: d1ef553456f825ac8c7be3da90410cc2b0ef3682e35099335e8a39adc4effb58
Opcode Fuzzy Hash: 18c12dbcc743baeea212ecce8a66d39814213ff7824e53a94a812b0ef6bbb1c2
Instruction Fuzzy Hash: 9E315E75A14518DFDB00DF94D884FAEBBB4FF48314F098099E805AB3A6DB31E855CB90

Function 009816C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0093FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00940668
Part of subcall function 0093FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00940685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0098170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0098173A
GetLastError.KERNEL32 ref: 0098174A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: e30283b601e80ee2e120ba2195f9682d5322a1a690178f86f8fa33964ce92db7
Instruction ID: 7c400c3258347acab0f82a58b7a5c4c72de7cc1a93e1fea4bb3ae17aacb1894e
Opcode Fuzzy Hash: e30283b601e80ee2e120ba2195f9682d5322a1a690178f86f8fa33964ce92db7
Instruction Fuzzy Hash: 0F1191B2814305AFD718AF54DC86E6AB7BDEF44724B20852EF05657681EB70BC428B20

Function 0098D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0098D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0098D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0098D650

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 6f4d5545401d3c1f62089a364dde1d63301765d23800831d215b3a6320dc16d4
Instruction ID: 6086b9729740db8e73a8ad3e0c564c91e09a66adc3637e6200999257c84447dd
Opcode Fuzzy Hash: 6f4d5545401d3c1f62089a364dde1d63301765d23800831d215b3a6320dc16d4
Instruction Fuzzy Hash: 24118EB1E05228BFDB108F98EC44FAFBBBCEB45B60F108125F904E7290D2704A018BA1

Function 00981663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0098168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 009816A1
FreeSid.ADVAPI32(?), ref: 009816B1

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: a1d4ce1e3794a2afae7132cc961a134b63c7327222fd265f132f73051c30e0f0
Instruction ID: 573c9b9a324abfb9bcf67df0f4f7d47e5bc54328d215dbc65cad85dcf8654c1c
Opcode Fuzzy Hash: a1d4ce1e3794a2afae7132cc961a134b63c7327222fd265f132f73051c30e0f0
Instruction Fuzzy Hash: B0F0F4B1954309FBDF00EFE49D89AAEBBBCFB08614F504565E501E2181E774AA449B60

Function 00944CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(009528E9,?,00944CBE,009528E9,009E88B8,0000000C,00944E15,009528E9,00000002,00000000,?,009528E9), ref: 00944D09
TerminateProcess.KERNEL32(00000000,?,00944CBE,009528E9,009E88B8,0000000C,00944E15,009528E9,00000002,00000000,?,009528E9), ref: 00944D10
ExitProcess.KERNEL32 ref: 00944D22

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ee47a543dfd2af961f06a58539eec60ba59e5341b2afdc4c719ceea583b9ed54
Instruction ID: f20d8a0bc7d05ef636eff22eddaac7011bc97b6033203042ad6738b846b0f7e4
Opcode Fuzzy Hash: ee47a543dfd2af961f06a58539eec60ba59e5341b2afdc4c719ceea583b9ed54
Instruction Fuzzy Hash: 8DE0B671418148ABCF11AF54DE0AF583BA9EB81791B508118FC099A162CB35ED42DB80

Function 0097D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0097D28C

Strings

X64, xrefs: 0097D2A8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 55b6929827e9c769f9729410b4aa58035b2cacb842ce968905a7c1e172f957c1
Instruction ID: c824eb5fe7882f88499604958bcc4d83619c83065254a95d26192713e0a97c3c
Opcode Fuzzy Hash: 55b6929827e9c769f9729410b4aa58035b2cacb842ce968905a7c1e172f957c1
Instruction Fuzzy Hash: 13D0CAB581612DEBCF94DBA0EC88DDEB3BCBF04305F104A92F50AA2000DB3896499F20

Function 0094CAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: fbc41f8b0b44a543524c1c49418268373614e5dcbf68c1f61cab0d861434d33f
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 28023DB1E011199FDF54CFA9C880AAEBBF5EF88314F258569D819E7380D731AE418B84

Function 009968EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00996918
FindClose.KERNEL32(00000000), ref: 00996961

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 85cf961b74992a3e4c3ce38be95056e7d4233139a17f50a20924a3f18523cfdb
Instruction ID: 5b4d175818388a96afd198c39f1e72eff8d0134e4d9eb1b25aa9d5e3274ff0b2
Opcode Fuzzy Hash: 85cf961b74992a3e4c3ce38be95056e7d4233139a17f50a20924a3f18523cfdb
Instruction Fuzzy Hash: 231190716142109FDB10DF69D484A1ABBE5FF89328F14C699F4698F6A6C730EC05CB91

Function 009937B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,009A4891,?,?,00000035,?), ref: 009937E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,009A4891,?,?,00000035,?), ref: 009937F4

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 42bd67af86f8d7ba0097ab88ff4af6e417ae9ab6864dee59e0b0f2fe29013acb
Instruction ID: 0db2a6af40e5e4e83d6cb360866307c1473dfe8b3dbf5a9387d48439a5100848
Opcode Fuzzy Hash: 42bd67af86f8d7ba0097ab88ff4af6e417ae9ab6864dee59e0b0f2fe29013acb
Instruction Fuzzy Hash: CBF0E5B06042292AEB2057AA9C4DFEB3AAEEFC4771F004265F509E2291DA609904C6B0

Function 009810BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,009811FC), ref: 009810D4
CloseHandle.KERNEL32(?,?,009811FC), ref: 009810E9

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 56962b3ba06dc499fbe9ea121fa5bd6fa185b39b37ba94cdf9edd8c8d9d0f5ed
Instruction ID: 2894a06156c3160c5bab044acc535df36ea2fd810ea847b5808e7899b0e586ce
Opcode Fuzzy Hash: 56962b3ba06dc499fbe9ea121fa5bd6fa185b39b37ba94cdf9edd8c8d9d0f5ed
Instruction Fuzzy Hash: 12E0BF72418610AFE7252B51FD09F7777EDEB44320F14892DF5A5804B5DB62AC90EB50

Function 0092CAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00970C40

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: c92de88afbe70fdaf04ff0e7986140cc1c4af9a912302550d7806ac7a5923f23
Instruction ID: bca70520e68a53f7d831c140532fd40aeba8f5b9810201531bbf741c19722677
Opcode Fuzzy Hash: c92de88afbe70fdaf04ff0e7986140cc1c4af9a912302550d7806ac7a5923f23
Instruction Fuzzy Hash: F332E2B1900228DFCF14DF90E985BEDB7B9FF84304F148459E80AAB296D775AE45CB60

Function 0095676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00956766,?,?,00000008,?,?,0095FEFE,00000000), ref: 00956998

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 849ec1674daa8f3f32f1170a10a32250d11602cf15946e7d646b9ac05c0c4441
Instruction ID: eef711a84d617948a33429ba021d4947f98482989648e2a413487372e887fd30
Opcode Fuzzy Hash: 849ec1674daa8f3f32f1170a10a32250d11602cf15946e7d646b9ac05c0c4441
Instruction Fuzzy Hash: 7FB17B31610608DFD719CF29C48AB647BE0FF45366F698658ED99CF2A2C335E989CB40

Function 0093B119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 0097851F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b7566286dce1dfa0733832165e64a2961bffc2f67f8ca52692c8eb0c79bdff0e
Instruction ID: 6bb4c99c49cb1c4f481b5ce6dbf2facc5df3367b1ce9c833faff3d38ded58eb1
Opcode Fuzzy Hash: b7566286dce1dfa0733832165e64a2961bffc2f67f8ca52692c8eb0c79bdff0e
Instruction Fuzzy Hash: 1F125E75E002299BCB14CF58C8857EEB7F5FF48710F14819AE949EB255EB349A81CF90

Function 0099EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0099EABD

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: f2742052b758cee46ca8d57f5b6568bf842c76fb2fc0d7bc0809e94d9c623b1d
Instruction ID: e81e022013f57fad06cf47ce87348aacce256258baa21c4aa7c8c5778a9848f2
Opcode Fuzzy Hash: f2742052b758cee46ca8d57f5b6568bf842c76fb2fc0d7bc0809e94d9c623b1d
Instruction Fuzzy Hash: 00E01A752102159FD710EF59E804E9AB7E9AF98760F048426FC49CB261DA70A8418BA0

Function 009409D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,009403EE), ref: 009409DA

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8c379dcbf634a2b01c7d04bd7960d02d811b3f923add5825e3c3ea9f211a4bd6
Instruction ID: dd733e4a99ad9069d2cfc3b0cf81f7056c142fdfe89bfe4d8bd3254d277a6825
Opcode Fuzzy Hash: 8c379dcbf634a2b01c7d04bd7960d02d811b3f923add5825e3c3ea9f211a4bd6
Instruction Fuzzy Hash:

Function 0094781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0094798B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: bc6006beaba3cf45f66d205fdb2b625daadc2391e575f99e9caf4e574773a9f5
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 5951457160C64D6BDB3885E888DEFBFE38D9B52340F180919E882D7382CB19DE45D356

Function 00956DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7a8ee152f1a6bcfa36be670857270d6e027b0be10a1f9802aa9301ee07b8cb
Instruction ID: 8be4e35a1f492c1a29264551efed96c48f1d23cf6222f6ebf29e509b781d8a1b
Opcode Fuzzy Hash: 4e7a8ee152f1a6bcfa36be670857270d6e027b0be10a1f9802aa9301ee07b8cb
Instruction Fuzzy Hash: 48321022D2DF014DD7239635E822336A24DAFB73C6F15D737F81AB59A6EB28C5835200

Function 0093CC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b49e6ba720529928c40ca29afa919f7db8baedf4cd74dc8025e0379c0baa28
Instruction ID: 1770be7b9c62307d3531133eaad34bfea19d439177b335762ce5d284f7d22690
Opcode Fuzzy Hash: 39b49e6ba720529928c40ca29afa919f7db8baedf4cd74dc8025e0379c0baa28
Instruction Fuzzy Hash: 743215B3A045458BDF28CF28C4D467D77A9EB45301F28C96ED88EAB291E634DD82DF41

Function 00927920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e655dc4f5a6d5cd668d47d4acff669504ca272870c5787d370fdc24b04dcb3c1
Instruction ID: 2b9da7b0986e2fe2370217adf0bde041b821b3a0513b4b04d4b3a53c0776c590
Opcode Fuzzy Hash: e655dc4f5a6d5cd668d47d4acff669504ca272870c5787d370fdc24b04dcb3c1
Instruction Fuzzy Hash: AA22AFB0A0461ADFDF14CFA5D881BAEF3B5FF44300F244529E816AB295EB39AD54CB50

Function 009291C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b1135aff97dcd591e1cab9bc3b2acc04a665b722a50caf350f242e074377bf
Instruction ID: ea738023e464fd0febddef0aef621e1f66e6a5593b7752c2104b53dbccf99205
Opcode Fuzzy Hash: 21b1135aff97dcd591e1cab9bc3b2acc04a665b722a50caf350f242e074377bf
Instruction Fuzzy Hash: C502C6B5E0021AEFDB04DF64D881BAEB7B5FF44300F508569E8169B295EB35AE10CF91

Function 00959EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3f7fd3f9d97e1ea527cec59ab66e49f4bea5788dc173764240fa0b709b31f3
Instruction ID: 2f7b99397f21352bf8358eb0d4bdb08eeb15591e7d19f88daf68f74565080d28
Opcode Fuzzy Hash: 2d3f7fd3f9d97e1ea527cec59ab66e49f4bea5788dc173764240fa0b709b31f3
Instruction Fuzzy Hash: 42B1F120D3AF814DD32396398831336B65CAFBB6D5F91D71BFC2674D62EB2686835240

Function 00941C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: ca50d758f2a9dd4cf5bd31e18bdc7eb308e95a42b8a1387647047ee6fa26cee5
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 219189766080E34ADB2D463E857483EFFE55A923A231A079ED4F2CB1C5FE24D9D4D620

Function 00941F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: d0fcc4bc8da8602ecd29bdd39aa84fc77e962e2e4ec3d7876dfca8c372facdce
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: E491677220D0E349DB6D4339857483EFFE56A923A135A079DF4F2CB1C5EE24D598D620

Function 009419B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: eafc9d7e6ea5995ce9899ddf7fe7847f95620ebcd4a71dd790162d164f0dec25
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 8591A6722090E34EDB2D467A957483EFFE59A923A231A079ED4F2CB1C5FE24C5D4D620

Function 00947A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5e3f1b366cb828b96da179efcf5e1f99bbba482cc608d88504b01e05b6dd604
Instruction ID: 77e7c32b0a1558f2ea27ec898c8f8b0325c93cd8fd9e1f02bb7121e466577563
Opcode Fuzzy Hash: a5e3f1b366cb828b96da179efcf5e1f99bbba482cc608d88504b01e05b6dd604
Instruction Fuzzy Hash: 7461697160874D56EE349AE88DA5FBFE39CDF81704F100E1EE982DB281DB159E42C355

Function 00947CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d14955de76b628c1b8977548031f145a97b4bec06631620ef39e69195db36a37
Instruction ID: 5708aee9cb87baa5f4c909256829614b6ff208b566d21cb9b39ff1390fd53e8e
Opcode Fuzzy Hash: d14955de76b628c1b8977548031f145a97b4bec06631620ef39e69195db36a37
Instruction Fuzzy Hash: 5E619931A2C70D66CE389AE84895FBFE38CDF82708F100E49E942DB2D1DB169D42C351

Function 00941706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 9b6974e6119622ec3774402c66fd352ac1eff64da23de1c36b309658d039e696
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: E38175366090E34ADB6D467A853483EFFE55A923A131A079ED4F2CB2C1FE24C594E620

Function 00992046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0fd441bbc68601c2882e79f4b7ce6cd82f763b336e450fd24cc8a3923e2179e
Instruction ID: a82a4ce2c2197bcbd835f446cd30781f2773b5c95d47ffb5900b8e516988e672
Opcode Fuzzy Hash: c0fd441bbc68601c2882e79f4b7ce6cd82f763b336e450fd24cc8a3923e2179e
Instruction Fuzzy Hash: 6D21A8326306158BDB28CF79C81367E73E9A754310F15862EE4A7C37D1DE35A904D780

Function 009A2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 009A2B30
DeleteObject.GDI32(00000000), ref: 009A2B43
DestroyWindow.USER32 ref: 009A2B52
GetDesktopWindow.USER32 ref: 009A2B6D
GetWindowRect.USER32(00000000), ref: 009A2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 009A2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 009A2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009A2CF8
GetClientRect.USER32(00000000,?), ref: 009A2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 009A2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009A2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009A2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009A2D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009A2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009A2D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009A2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009A2DA8
GlobalFree.KERNEL32(00000000), ref: 009A2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009A2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,009BFC38,00000000), ref: 009A2DDB
GlobalFree.KERNEL32(00000000), ref: 009A2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 009A2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 009A2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009A2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009A303F

Strings

static, xrefs: 009A2D3A, 009A2E91
, xrefs: 009A2FC5
DISPLAY, xrefs: 009A2EA2
AutoIt v3, xrefs: 009A2CF2

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: d0a8e9f813b5ccdf950940fd2abb84315958bd31d5612de22189be737475e80b
Instruction ID: 1edf5e548f43e2c52fff3c1d606b7bbae80a793c3df24ebb0bf35e143b706628
Opcode Fuzzy Hash: d0a8e9f813b5ccdf950940fd2abb84315958bd31d5612de22189be737475e80b
Instruction Fuzzy Hash: DD027EB1910215EFDB14DF68CD89EAE7BB9EF49720F008158F915AB2A1C774ED01DBA0

Function 009B70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 009B712F
GetSysColorBrush.USER32(0000000F), ref: 009B7160
GetSysColor.USER32(0000000F), ref: 009B716C
SetBkColor.GDI32(?,000000FF), ref: 009B7186
SelectObject.GDI32(?,?), ref: 009B7195
InflateRect.USER32(?,000000FF,000000FF), ref: 009B71C0
GetSysColor.USER32(00000010), ref: 009B71C8
CreateSolidBrush.GDI32(00000000), ref: 009B71CF
FrameRect.USER32(?,?,00000000), ref: 009B71DE
DeleteObject.GDI32(00000000), ref: 009B71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 009B7230
FillRect.USER32(?,?,?), ref: 009B7262
GetWindowLongW.USER32(?,000000F0), ref: 009B7284

Part of subcall function 009B73E8: GetSysColor.USER32(00000012), ref: 009B7421
Part of subcall function 009B73E8: SetTextColor.GDI32(?,?), ref: 009B7425
Part of subcall function 009B73E8: GetSysColorBrush.USER32(0000000F), ref: 009B743B
Part of subcall function 009B73E8: GetSysColor.USER32(0000000F), ref: 009B7446
Part of subcall function 009B73E8: GetSysColor.USER32(00000011), ref: 009B7463
Part of subcall function 009B73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 009B7471
Part of subcall function 009B73E8: SelectObject.GDI32(?,00000000), ref: 009B7482
Part of subcall function 009B73E8: SetBkColor.GDI32(?,00000000), ref: 009B748B
Part of subcall function 009B73E8: SelectObject.GDI32(?,?), ref: 009B7498
Part of subcall function 009B73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 009B74B7
Part of subcall function 009B73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 009B74CE
Part of subcall function 009B73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 009B74DB

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 38bdc02b9914943a79c2111d9c0863ee629106b9d6e1b0984c9029a462da7bcb
Instruction ID: 82abe4d4cd288f0088decacf77170599670d400d4f18b8df26cf2ecf7b9e4910
Opcode Fuzzy Hash: 38bdc02b9914943a79c2111d9c0863ee629106b9d6e1b0984c9029a462da7bcb
Instruction Fuzzy Hash: 16A192B201C301AFD7109FA4DD48A9BB7A9FB89330F100B19F9A2961E1D775E944DB61

Function 00938D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00938E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00976AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00976AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00976F43

Part of subcall function 00938F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00938BE8,?,00000000,?,?,?,?,00938BBA,00000000,?), ref: 00938FC5

SendMessageW.USER32(?,00001053), ref: 00976F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00976F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00976FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00976FB7

Strings

0, xrefs: 00976DCF

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: f8acf092cf99f9d1baeaf43e50ecd4eded5dbb5490292065b7fa7672e0b62a9c
Instruction ID: 8b25072d50b5facf9e8df113a08baa0c6f5242065003d0c8590b598ab9d54ca5
Opcode Fuzzy Hash: f8acf092cf99f9d1baeaf43e50ecd4eded5dbb5490292065b7fa7672e0b62a9c
Instruction Fuzzy Hash: E612AB32208601EFDB25DF24D944BA6BBE9FB45310F188569F489CB261CB71EC91DF91

Function 009A2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 009A273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 009A286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 009A28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 009A28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 009A2900
GetClientRect.USER32(00000000,?), ref: 009A290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 009A2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 009A2964
GetStockObject.GDI32(00000011), ref: 009A2974
SelectObject.GDI32(00000000,00000000), ref: 009A2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 009A2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 009A2991
DeleteDC.GDI32(00000000), ref: 009A299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 009A29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 009A29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 009A2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 009A2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 009A2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 009A2A77
GetStockObject.GDI32(00000011), ref: 009A2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 009A2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 009A2A97

Strings

static, xrefs: 009A294F, 009A2A71
msctls_progress32, xrefs: 009A2A13
DISPLAY, xrefs: 009A295A
AutoIt v3, xrefs: 009A28F8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 6493ecb9476054bf2e0031a48e26cd2ce2b66740f1c0b2f547cb686e80e8109f
Instruction ID: b19180b940e7b984e585eb8f3ff9b033808b3c7d3929e8f458023318835437de
Opcode Fuzzy Hash: 6493ecb9476054bf2e0031a48e26cd2ce2b66740f1c0b2f547cb686e80e8109f
Instruction Fuzzy Hash: 0FB16DB1A14215AFEB14DFA8DD49FAEBBB9EB49710F004214F915EB290D774ED40CBA0

Function 00994ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00994AED
GetDriveTypeW.KERNEL32(?,009BCB68,?,\\.\,009BCC08), ref: 00994BCA
SetErrorMode.KERNEL32(00000000,009BCB68,?,\\.\,009BCC08), ref: 00994D36

Strings

ATA, xrefs: 00994C98
Network, xrefs: 00994C02
Unknown, xrefs: 00994BED, 00994C83
1394, xrefs: 00994C9F
\\.\, xrefs: 00994B3F
SATA, xrefs: 00994CD0
Fibre, xrefs: 00994CAD
Removable, xrefs: 00994C10, 00994C15
RAMDisk, xrefs: 00994BF4
SAS, xrefs: 00994CC9
USB, xrefs: 00994CB4
MMC, xrefs: 00994CDE
Virtual, xrefs: 00994CE5
SSA, xrefs: 00994CA6
Fixed, xrefs: 00994C09
FileBackedVirtual, xrefs: 00994CEC
ATAPI, xrefs: 00994C91
SCSI, xrefs: 00994C8A
SSD, xrefs: 00994C4A
RAID, xrefs: 00994CBB
iSCSI, xrefs: 00994CC2
PhysicalDrive, xrefs: 00994B76
CDROM, xrefs: 00994BFB

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 4f58d3810cc9193b4a9532a8b31f686be20809fedc2c564fa3ddacc5c62c3378
Instruction ID: 38b75c77facbbb90ec32b77fd74017cc4a5ee21cc3998fcd5c1ba4f50f7ebb14
Opcode Fuzzy Hash: 4f58d3810cc9193b4a9532a8b31f686be20809fedc2c564fa3ddacc5c62c3378
Instruction Fuzzy Hash: C761D530605245DFCF17DF2DCE81EAC77A4AB98344B248855F846AB291EB39ED82DB41

Function 009B73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 009B7421
SetTextColor.GDI32(?,?), ref: 009B7425
GetSysColorBrush.USER32(0000000F), ref: 009B743B
GetSysColor.USER32(0000000F), ref: 009B7446
CreateSolidBrush.GDI32(?), ref: 009B744B
GetSysColor.USER32(00000011), ref: 009B7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 009B7471
SelectObject.GDI32(?,00000000), ref: 009B7482
SetBkColor.GDI32(?,00000000), ref: 009B748B
SelectObject.GDI32(?,?), ref: 009B7498
InflateRect.USER32(?,000000FF,000000FF), ref: 009B74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 009B74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 009B74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 009B752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 009B7554
InflateRect.USER32(?,000000FD,000000FD), ref: 009B7572
DrawFocusRect.USER32(?,?), ref: 009B757D
GetSysColor.USER32(00000011), ref: 009B758E
SetTextColor.GDI32(?,00000000), ref: 009B7596
DrawTextW.USER32(?,009B70F5,000000FF,?,00000000), ref: 009B75A8
SelectObject.GDI32(?,?), ref: 009B75BF
DeleteObject.GDI32(?), ref: 009B75CA
SelectObject.GDI32(?,?), ref: 009B75D0
DeleteObject.GDI32(?), ref: 009B75D5
SetTextColor.GDI32(?,?), ref: 009B75DB
SetBkColor.GDI32(?,?), ref: 009B75E5

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 398cee42475753cd927c649923c51a1d4fa0dbd1e71a134459d63d3d670eacc1
Instruction ID: b2f42db78514476f1148901fc5c57cbfe49492cb6ebc0701b23fbee2431a6291
Opcode Fuzzy Hash: 398cee42475753cd927c649923c51a1d4fa0dbd1e71a134459d63d3d670eacc1
Instruction Fuzzy Hash: 456160B2908218AFDF119FA4DD49EEEBF79EB48330F104615F911BB2A1D7749940DB90

Function 009B0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 009B1128
GetDesktopWindow.USER32 ref: 009B113D
GetWindowRect.USER32(00000000), ref: 009B1144
GetWindowLongW.USER32(?,000000F0), ref: 009B1199
DestroyWindow.USER32(?), ref: 009B11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 009B11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 009B120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 009B121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 009B1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 009B1245
IsWindowVisible.USER32(00000000), ref: 009B12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 009B12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 009B12D0
GetWindowRect.USER32(00000000,?), ref: 009B12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 009B130E
GetMonitorInfoW.USER32(00000000,?), ref: 009B1328
CopyRect.USER32(?,?), ref: 009B133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 009B13AA

Strings

0, xrefs: 009B10D3
tooltips_class32, xrefs: 009B11E6
(, xrefs: 009B131B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 6cf9525a135529d347f809ff747a959894096628c2edd00e8b189a90a05016f8
Instruction ID: 67e1824e9053c22d089f2fe2bcccc76d61341c5a96872d60e4305d95a952f64f
Opcode Fuzzy Hash: 6cf9525a135529d347f809ff747a959894096628c2edd00e8b189a90a05016f8
Instruction Fuzzy Hash: C7B1AD71608351AFD700DF64CA94FAABBE4FF88360F40891CF9999B2A1D771E844CB91

Function 00938891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00938968
GetSystemMetrics.USER32(00000007), ref: 00938970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0093899B
GetSystemMetrics.USER32(00000008), ref: 009389A3
GetSystemMetrics.USER32(00000004), ref: 009389C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 009389E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 009389F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00938A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00938A3C
GetClientRect.USER32(00000000,000000FF), ref: 00938A5A
GetStockObject.GDI32(00000011), ref: 00938A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00938A81

Part of subcall function 0093912D: GetCursorPos.USER32(?), ref: 00939141
Part of subcall function 0093912D: ScreenToClient.USER32(00000000,?), ref: 0093915E
Part of subcall function 0093912D: GetAsyncKeyState.USER32(00000001), ref: 00939183
Part of subcall function 0093912D: GetAsyncKeyState.USER32(00000002), ref: 0093919D

SetTimer.USER32(00000000,00000000,00000028,009390FC), ref: 00938AA8

Strings

AutoIt v3 GUI, xrefs: 00938A20

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 5e34a60dc99615f1b9109c8bb74ff1848cdaaf1f6327090ec23aec7525a0d561
Instruction ID: 7f40b52733f05307febe489e4836701f70fba47126256f1f32ced775660dab2e
Opcode Fuzzy Hash: 5e34a60dc99615f1b9109c8bb74ff1848cdaaf1f6327090ec23aec7525a0d561
Instruction Fuzzy Hash: 34B16C71A0420AEFDB14DFA8DD45BAE7BB5FB48314F108229FA15A7290DB74E840DF91

Function 00980D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009810F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00981114
Part of subcall function 009810F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00980B9B,?,?,?), ref: 00981120
Part of subcall function 009810F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00980B9B,?,?,?), ref: 0098112F
Part of subcall function 009810F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00980B9B,?,?,?), ref: 00981136
Part of subcall function 009810F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0098114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00980DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00980E29
GetLengthSid.ADVAPI32(?), ref: 00980E40
GetAce.ADVAPI32(?,00000000,?), ref: 00980E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00980E96
GetLengthSid.ADVAPI32(?), ref: 00980EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00980EB5
HeapAlloc.KERNEL32(00000000), ref: 00980EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00980EDD
CopySid.ADVAPI32(00000000), ref: 00980EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00980F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00980F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00980F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00980F6E
HeapFree.KERNEL32(00000000), ref: 00980F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00980F7E
HeapFree.KERNEL32(00000000), ref: 00980F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00980F8E
HeapFree.KERNEL32(00000000), ref: 00980F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00980FA1
HeapFree.KERNEL32(00000000), ref: 00980FA8

Part of subcall function 00981193: GetProcessHeap.KERNEL32(00000008,00980BB1,?,00000000,?,00980BB1,?), ref: 009811A1
Part of subcall function 00981193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00980BB1,?), ref: 009811A8
Part of subcall function 00981193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00980BB1,?), ref: 009811B7

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: bc84ded86e239d0fb1bc4aaf7f8aa62f2b2618aa2d178e4678a9353d76f7f5eb
Instruction ID: 9a7779e2c966aa6d6ffdb8efd14488c37fbe317468b4c4c7d3ff3e6a7dfd673f
Opcode Fuzzy Hash: bc84ded86e239d0fb1bc4aaf7f8aa62f2b2618aa2d178e4678a9353d76f7f5eb
Instruction Fuzzy Hash: E17150B190420AEBDF60AFA4DD44FAEBBBCBF44350F048215FA15E6251D7319909CB60

Function 009AC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009AC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,009BCC08,00000000,?,00000000,?,?), ref: 009AC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 009AC5A4
_wcslen.LIBCMT ref: 009AC5F4
_wcslen.LIBCMT ref: 009AC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 009AC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 009AC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 009AC84D
RegCloseKey.ADVAPI32(?), ref: 009AC881
RegCloseKey.ADVAPI32(00000000), ref: 009AC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 009AC960

Strings

REG_MULTI_SZ, xrefs: 009AC6F5
REG_EXPAND_SZ, xrefs: 009AC5CD
REG_DWORD, xrefs: 009AC804
REG_QWORD, xrefs: 009AC8C3
REG_SZ, xrefs: 009AC644
REG_BINARY, xrefs: 009AC913

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: d7cdfa8bd0fdf535cc383230cec0fd6827245084182944eba6f34aba0a17bf22
Instruction ID: 0c2f4257541e692eef454cec65520fd94237dd862fdf4d6bc98daf7aa7790968
Opcode Fuzzy Hash: d7cdfa8bd0fdf535cc383230cec0fd6827245084182944eba6f34aba0a17bf22
Instruction Fuzzy Hash: 501235756082119FDB14DF14D891F2AB7E5BF89714F04885CF88AAB3A2DB35ED41CB81

Function 009B091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 009B09C6
_wcslen.LIBCMT ref: 009B0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 009B0A54
_wcslen.LIBCMT ref: 009B0A8A
_wcslen.LIBCMT ref: 009B0B06
_wcslen.LIBCMT ref: 009B0B81

Part of subcall function 0093F9F2: _wcslen.LIBCMT ref: 0093F9FD

Part of subcall function 00982BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00982BFA

Strings

EXPAND, xrefs: 009B0BF8
GETTOTALCOUNT, xrefs: 009B09F2, 009B0A17
COLLAPSE, xrefs: 009B0B01, 009B0B1C
ISCHECKED, xrefs: 009B0CE1
SELECT, xrefs: 009B0D11
GETITEMCOUNT, xrefs: 009B0C1E
GETTEXT, xrefs: 009B0C97
EXISTS, xrefs: 009B0B7C, 009B0B97
CHECK, xrefs: 009B0A85, 009B0AA0
GETSELECTED, xrefs: 009B0C4E
UNCHECK, xrefs: 009B0D3E

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 4de51f752acb9cbf504dac4ac0650bc2a34b80f384f630f6fd6eb1cd467923aa
Instruction ID: b2f7037562cce30ea0d62d67348f98804f2055958b6a075bef0c4d5601bb762b
Opcode Fuzzy Hash: 4de51f752acb9cbf504dac4ac0650bc2a34b80f384f630f6fd6eb1cd467923aa
Instruction Fuzzy Hash: ADE19A312083118FCB14EF65C550AAAB7E5BFD8324F14895DF896AB3A2DB30ED45CB81

Function 009AC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,009AB6AE,?,?), ref: 009AC9B5
_wcslen.LIBCMT ref: 009AC9F1
_wcslen.LIBCMT ref: 009ACA68
_wcslen.LIBCMT ref: 009ACA9E
_wcslen.LIBCMT ref: 009ACAF9
_wcslen.LIBCMT ref: 009ACB2F
_wcslen.LIBCMT ref: 009ACB7F

Strings

HKCC, xrefs: 009ACBAC
HKLM, xrefs: 009ACA98, 009ACA9D
HKEY_LOCAL_MACHINE, xrefs: 009ACA62, 009ACA67
HKCR, xrefs: 009ACB29, 009ACB2E
HKEY_USERS, xrefs: 009ACBDF
HKEY_CURRENT_CONFIG, xrefs: 009ACB79, 009ACB7E
HKU, xrefs: 009ACBF0
HKCU, xrefs: 009ACBCE
HKEY_CLASSES_ROOT, xrefs: 009ACAF3, 009ACAF8
HKEY_CURRENT_USER, xrefs: 009ACBBD

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 822bd8756bcb6e0cbd2279f193e254feff0618e3e672cd2a6af6e868974388fc
Instruction ID: c2b49d5d6279aa5e6bbbba8e87dec003a7f8d40584e3a847a4bd9b9250aa70c5
Opcode Fuzzy Hash: 822bd8756bcb6e0cbd2279f193e254feff0618e3e672cd2a6af6e868974388fc
Instruction Fuzzy Hash: 6F7126B360056A8BCB20DE7CCD516BF33A9AFA2764F110524F8569F284EA36CD41C3E1

Function 009B833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009B835A
_wcslen.LIBCMT ref: 009B836E
_wcslen.LIBCMT ref: 009B8391
_wcslen.LIBCMT ref: 009B83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 009B83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,009B361A,?), ref: 009B844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 009B8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 009B84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 009B8501
FreeLibrary.KERNEL32(?), ref: 009B850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 009B851D
DestroyIcon.USER32(?), ref: 009B852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 009B8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 009B8555

Strings

.exe, xrefs: 009B8388
.icl, xrefs: 009B8368
.dll, xrefs: 009B83AB

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 29d384432f6426dde95f4a09d840f77a7ee9b5b0777f382ced3d6cb72fadc89d
Instruction ID: ca113e8b352afdf35af56e251f7f2a31ddfd7b2fda9dda7796f47fc6555f8206
Opcode Fuzzy Hash: 29d384432f6426dde95f4a09d840f77a7ee9b5b0777f382ced3d6cb72fadc89d
Instruction Fuzzy Hash: 9761DF71504219BAEB249F64CD81FFF77ACBB48B20F104649F815E60D0DFB4A940D7A0

Function 00927778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#requireadmin, xrefs: 009277FF
', xrefs: 00965169
#OnAutoItStartRegister, xrefs: 00927817
#include, xrefs: 00927847
", xrefs: 00965153
#pragma compile, xrefs: 009277D3
#ce, xrefs: 009278ED
#comments-end, xrefs: 009278D9
Bad directive syntax error, xrefs: 0096519A
Unterminated group of comments, xrefs: 0096528C
#cs, xrefs: 00927873, 009278C5
Cannot parse #include, xrefs: 00965279
#notrayicon, xrefs: 009277E7
#comments-start, xrefs: 0092785F, 009278B1
#include-once, xrefs: 0092782F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 44a4f55c49c9dcbe1298fe65a4caf60c55a3b2b65c1a5f2baf30367e9934569c
Instruction ID: 372efb59bf305133e1fa3fc29d6006985fdf00a9addefb0407a03d3941ec6bdf
Opcode Fuzzy Hash: 44a4f55c49c9dcbe1298fe65a4caf60c55a3b2b65c1a5f2baf30367e9934569c
Instruction Fuzzy Hash: 48813B71604225BBDB20BFA0EC52FAF77ACAF95304F054424F904BB19AEB70DA01C791

Function 00993E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00993EF8
_wcslen.LIBCMT ref: 00993F03
_wcslen.LIBCMT ref: 00993F5A
_wcslen.LIBCMT ref: 00993F98
GetDriveTypeW.KERNEL32(?), ref: 00993FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0099401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00994059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00994087

Strings

close, xrefs: 00993EFE, 00993F18
type cdaudio alias cd wait, xrefs: 00994001
wait, xrefs: 00994044
set cd door , xrefs: 00994028
close cd wait, xrefs: 00994072
open , xrefs: 00993FE5
open, xrefs: 00993F54, 00993F59
closed, xrefs: 00993F08, 00993F2D, 00993F46, 00993F7E, 00993F97

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: a8596a952ae17b97a9a53ba4cb458b65e747541d32c4f9690883b4bc3e3948c2
Instruction ID: 8396efc6ea70ed958f3fc71c98b8403ad710408e91a4a0efa69d5129c58781bb
Opcode Fuzzy Hash: a8596a952ae17b97a9a53ba4cb458b65e747541d32c4f9690883b4bc3e3948c2
Instruction Fuzzy Hash: D271E2726043119FCB10DF28C88096AB7F8FFA8768F10892DF99597255EB31ED46CB91

Function 00985A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00985A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00985A40
SetWindowTextW.USER32(?,?), ref: 00985A57
GetDlgItem.USER32(?,000003EA), ref: 00985A6C
SetWindowTextW.USER32(00000000,?), ref: 00985A72
GetDlgItem.USER32(?,000003E9), ref: 00985A82
SetWindowTextW.USER32(00000000,?), ref: 00985A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00985AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00985AC3
GetWindowRect.USER32(?,?), ref: 00985ACC
_wcslen.LIBCMT ref: 00985B33
SetWindowTextW.USER32(?,?), ref: 00985B6F
GetDesktopWindow.USER32 ref: 00985B75
GetWindowRect.USER32(00000000), ref: 00985B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00985BD3
GetClientRect.USER32(?,?), ref: 00985BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00985C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00985C2F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: ed8ce38f96e2bfcb66913ced13605d8eca372c77fd9bc8196022633589d6078f
Instruction ID: 1b15d9a083d3e7659209d45b239924c2320ad38b35e33b5104f55dbf03438581
Opcode Fuzzy Hash: ed8ce38f96e2bfcb66913ced13605d8eca372c77fd9bc8196022633589d6078f
Instruction Fuzzy Hash: E0716F71900B05EFDB20EFA8CE85E6EBBF5FF48714F114618E142A26A0D775E944DB50

Function 0099FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0099FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0099FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0099FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0099FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0099FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0099FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0099FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0099FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0099FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0099FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0099FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0099FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0099FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0099FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0099FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0099FECC
GetCursorInfo.USER32(?), ref: 0099FEDC
GetLastError.KERNEL32 ref: 0099FF1E

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 6c6b103c17bbc430af19566765264cbd32c5a527946cd4e64f61fd760caaca1b
Instruction ID: 188cbe7f34c4bcc77582d89854d1e17caa4e496716952aca5b1509935d63a8f2
Opcode Fuzzy Hash: 6c6b103c17bbc430af19566765264cbd32c5a527946cd4e64f61fd760caaca1b
Instruction Fuzzy Hash: 614144B0D08319AADB10DFBA8C8985EBFE8FF44754B50452AE11DE7281DB789901CE91

Function 009400C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 009400C6

Part of subcall function 009400ED: InitializeCriticalSectionAndSpinCount.KERNEL32(009F070C,00000FA0,B708F0D4,?,?,?,?,009623B3,000000FF), ref: 0094011C
Part of subcall function 009400ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,009623B3,000000FF), ref: 00940127
Part of subcall function 009400ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,009623B3,000000FF), ref: 00940138
Part of subcall function 009400ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0094014E
Part of subcall function 009400ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0094015C
Part of subcall function 009400ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0094016A
Part of subcall function 009400ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00940195
Part of subcall function 009400ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 009401A0

___scrt_fastfail.LIBCMT ref: 009400E7

Part of subcall function 009400A3: __onexit.LIBCMT ref: 009400A9

Strings

SleepConditionVariableCS, xrefs: 00940154
kernel32.dll, xrefs: 00940133
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00940122
WakeAllConditionVariable, xrefs: 00940162
InitializeConditionVariable, xrefs: 00940148

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 533149fe701e8ecd7ff5d499771c962278483be00216c3d8855a7e098645b841
Instruction ID: 54c7919fc33dc238aee84c095dcefef4dd8467e638b76fd8b708e09e5c3f00db
Opcode Fuzzy Hash: 533149fe701e8ecd7ff5d499771c962278483be00216c3d8855a7e098645b841
Instruction Fuzzy Hash: AF213B72A5C7006BD7206B64AD55F6933DCEFC9B75F000235FA01A32D2DB749C009E90

Function 009830F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0098318D
_wcslen.LIBCMT ref: 009831F8

Strings

CLASS, xrefs: 00983188, 009831A5
REGEXPCLASS, xrefs: 00983255, 00983266
INSTANCE, xrefs: 00983453
CLASSNN, xrefs: 009831F3, 00983204
TEXT, xrefs: 0098347C
NAME, xrefs: 00983335, 00983346

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: ff851148f2f737f2771df359a79438b0f8bcf010e0e3180329c7c703b2e0bd43
Instruction ID: 4f1bce65e0901c371f945f2901294873da84d3dc025fe7d19f3a6aaf83d32180
Opcode Fuzzy Hash: ff851148f2f737f2771df359a79438b0f8bcf010e0e3180329c7c703b2e0bd43
Instruction Fuzzy Hash: 52E1E632A00616ABCB24AF78C451BEEBBB4BF54B10F54C129E456F7350DB30AE859790

Function 009944C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,009BCC08), ref: 00994527
_wcslen.LIBCMT ref: 0099453B
_wcslen.LIBCMT ref: 00994599
_wcslen.LIBCMT ref: 009945F4
_wcslen.LIBCMT ref: 0099463F
_wcslen.LIBCMT ref: 009946A7

Part of subcall function 0093F9F2: _wcslen.LIBCMT ref: 0093F9FD

GetDriveTypeW.KERNEL32(?,009E6BF0,00000061), ref: 00994743

Strings

cdrom, xrefs: 0099458F, 00994594
all, xrefs: 00994531, 00994536
removable, xrefs: 009945EA, 009945EF
network, xrefs: 0099469D, 009946A2
ramdisk, xrefs: 009946F1
fixed, xrefs: 00994635, 0099463A
unknown, xrefs: 00994708

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 88ce7480db2607cbbac03564fc1aacf3111bde9a6a2a5a5c470bc2f13d00377e
Instruction ID: 8bab49de74a9c3c08d70e6f02e96eba98b0e274e553086b0f10cd6824c3e32aa
Opcode Fuzzy Hash: 88ce7480db2607cbbac03564fc1aacf3111bde9a6a2a5a5c470bc2f13d00377e
Instruction Fuzzy Hash: E8B1FE716083029BCB21DF2CD890E6AB7E9BFE5760F50491DF496C7291E730D846CBA2

Function 009A3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,009BCC08), ref: 009A40BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 009A40CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,009BCC08), ref: 009A40F2
FreeLibrary.KERNEL32(00000000,?,009BCC08), ref: 009A413E
StringFromGUID2.OLE32(?,?,00000028,?,009BCC08), ref: 009A41A8
SysFreeString.OLEAUT32(00000009), ref: 009A4262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 009A42C8
SysFreeString.OLEAUT32(?), ref: 009A42F2

Strings

GetModuleHandleExW, xrefs: 009A40C7
kernel32.dll, xrefs: 009A40B6

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: a8fe55c357bcb14e56cc179d557f5841ebd6d6ea54ee1546ca67dae4c65cbe69
Instruction ID: 754d8549e0434bf9fb2d4076b87ce88cadc0da33f230bf430c8c1228c3464a7e
Opcode Fuzzy Hash: a8fe55c357bcb14e56cc179d557f5841ebd6d6ea54ee1546ca67dae4c65cbe69
Instruction Fuzzy Hash: A3124D75A00115EFDB14DF54C884EAEB7B9FF8A318F248498F9059B261D771ED42CBA0

Function 0092326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(009F1990), ref: 00962F8D
GetMenuItemCount.USER32(009F1990), ref: 0096303D
GetCursorPos.USER32(?), ref: 00963081
SetForegroundWindow.USER32(00000000), ref: 0096308A
TrackPopupMenuEx.USER32(009F1990,00000000,?,00000000,00000000,00000000), ref: 0096309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 009630A9

Strings

0, xrefs: 0092327D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: c01fdcbef1e0661b1e1c77c1d391c9c3a3b2cb3310843d953cf6178088fbaf1a
Instruction ID: add7379158ba59d7fc858afbd04cb55c0564eef1f2c9b088faab9eb83e9a2225
Opcode Fuzzy Hash: c01fdcbef1e0661b1e1c77c1d391c9c3a3b2cb3310843d953cf6178088fbaf1a
Instruction Fuzzy Hash: F8714870644616BFEB219F28DC49FAABF6DFF05324F204216F524AA1E0C7B5AD10DB90

Function 009B6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 009B6DEB

Part of subcall function 00926B57: _wcslen.LIBCMT ref: 00926B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 009B6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 009B6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 009B6E94
DestroyWindow.USER32(?), ref: 009B6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00920000,00000000), ref: 009B6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 009B6EFD
GetDesktopWindow.USER32 ref: 009B6F16
GetWindowRect.USER32(00000000), ref: 009B6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 009B6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 009B6F4D

Part of subcall function 00939944: GetWindowLongW.USER32(?,000000EB), ref: 00939952

Strings

0, xrefs: 009B6D98
tooltips_class32, xrefs: 009B6E58, 009B6EDD

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 86e66b75d094ff3b293a3606188bc01fbc667544bd3a3896aed5326cab5f769d
Instruction ID: 292047d502e6cba8bf22b20c22696a09ad1a7a57f53f6d71df9fe4c325ff2be6
Opcode Fuzzy Hash: 86e66b75d094ff3b293a3606188bc01fbc667544bd3a3896aed5326cab5f769d
Instruction Fuzzy Hash: 387187B1508245AFDB21CF28ED48FBABBE9FB89324F04091DF98987260C774E945DB51

Function 009B911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00939BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00939BB2

DragQueryPoint.SHELL32(?,?), ref: 009B9147

Part of subcall function 009B7674: ClientToScreen.USER32(?,?), ref: 009B769A
Part of subcall function 009B7674: GetWindowRect.USER32(?,?), ref: 009B7710
Part of subcall function 009B7674: PtInRect.USER32(?,?,009B8B89), ref: 009B7720

SendMessageW.USER32(?,000000B0,?,?), ref: 009B91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 009B91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 009B91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 009B9225
SendMessageW.USER32(?,000000B0,?,?), ref: 009B923E
SendMessageW.USER32(?,000000B1,?,?), ref: 009B9255
SendMessageW.USER32(?,000000B1,?,?), ref: 009B9277
DragFinish.SHELL32(?), ref: 009B927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 009B9371

Strings

@GUI_DRAGID, xrefs: 009B92E9
@GUI_DROPID, xrefs: 009B929E
@GUI_DRAGFILE, xrefs: 009B9320

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: cc2d5e169ac18478f0dd7e52e9cf054d46849e5adf1e94f1bc5b160381a14525
Instruction ID: 2fce7ad8be96ad8c9fe7d8a9eedeca6269fcd63af6a2c50de207d74d7569cbd8
Opcode Fuzzy Hash: cc2d5e169ac18478f0dd7e52e9cf054d46849e5adf1e94f1bc5b160381a14525
Instruction Fuzzy Hash: EC616A71108301AFC701DF64DD85EAFBBE9EFC9760F000A2DF595921A0DB709A49CB92

Function 0099C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0099C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0099C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0099C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0099C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0099C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0099C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0099C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0099C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0099C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0099C5F0
InternetCloseHandle.WININET(00000000), ref: 0099C5FB

Strings

, xrefs: 0099C575

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 8c3fffc8cfb01edacdb8dba8ccb949ed083a6b843332db78751a378f97c88d81
Instruction ID: ee71110498e842c261bb1f77f5086f8b1023633f59773f69ac2e12b8d91122ee
Opcode Fuzzy Hash: 8c3fffc8cfb01edacdb8dba8ccb949ed083a6b843332db78751a378f97c88d81
Instruction Fuzzy Hash: 06514AF1604209BFEF218F69CD88AAB7BFCFF48754F004519F94696250DB34E944ABA1

Function 009B856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 009B8592
GetFileSize.KERNEL32(00000000,00000000), ref: 009B85A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 009B85AD
CloseHandle.KERNEL32(00000000), ref: 009B85BA
GlobalLock.KERNEL32(00000000), ref: 009B85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 009B85D7
GlobalUnlock.KERNEL32(00000000), ref: 009B85E0
CloseHandle.KERNEL32(00000000), ref: 009B85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 009B85F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,009BFC38,?), ref: 009B8611
GlobalFree.KERNEL32(00000000), ref: 009B8621
GetObjectW.GDI32(?,00000018,000000FF), ref: 009B8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 009B8671
DeleteObject.GDI32(00000000), ref: 009B8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 009B86AF

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 20778ba29b739e5144d6e5ec2f96170f1f7c43205960ab1f3bc67d8de0171927
Instruction ID: df55741d6b51aac6f988db70c392f3519042e88941d986d4f53a0870e20fb725
Opcode Fuzzy Hash: 20778ba29b739e5144d6e5ec2f96170f1f7c43205960ab1f3bc67d8de0171927
Instruction Fuzzy Hash: A84149B1604209EFDB119FA5CE48EAB7BBCEF89B21F104158F915E7260DB709D01DB20

Function 009914BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00991502
VariantCopy.OLEAUT32(?,?), ref: 0099150B
VariantClear.OLEAUT32(?), ref: 00991517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 009915FB
VarR8FromDec.OLEAUT32(?,?), ref: 00991657
VariantInit.OLEAUT32(?), ref: 00991708
SysFreeString.OLEAUT32(?), ref: 0099178C
VariantClear.OLEAUT32(?), ref: 009917D8
VariantClear.OLEAUT32(?), ref: 009917E7
VariantInit.OLEAUT32(00000000), ref: 00991823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00991625
Default, xrefs: 009916AF

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 956cb37c34a202a3c595e5c356e884e52f0a843222fa55281d85f29d01b824ec
Instruction ID: 47013d17a1974902bd4d4a5bf0c2d57369fd4dc99384adac9e2973574e8169a6
Opcode Fuzzy Hash: 956cb37c34a202a3c595e5c356e884e52f0a843222fa55281d85f29d01b824ec
Instruction Fuzzy Hash: D7D13371A00116EBDF00DF69E885B7DB7B9BF84700F12845AF446AB290DB34ED41DBA2

Function 009AB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

Part of subcall function 009AC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,009AB6AE,?,?), ref: 009AC9B5
Part of subcall function 009AC998: _wcslen.LIBCMT ref: 009AC9F1
Part of subcall function 009AC998: _wcslen.LIBCMT ref: 009ACA68
Part of subcall function 009AC998: _wcslen.LIBCMT ref: 009ACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009AB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 009AB772
RegDeleteValueW.ADVAPI32(?,?), ref: 009AB80A
RegCloseKey.ADVAPI32(?), ref: 009AB87E
RegCloseKey.ADVAPI32(?), ref: 009AB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 009AB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 009AB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 009AB922
FreeLibrary.KERNEL32(00000000), ref: 009AB983
RegCloseKey.ADVAPI32(00000000), ref: 009AB994

Strings

RegDeleteKeyExW, xrefs: 009AB8FE
advapi32.dll, xrefs: 009AB8ED

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: c75cacda880fe9285c632b8e340322e0ab6004410d887ed0a5f5d8ca1c4ca242
Instruction ID: 3d56c0c58ce88e76e65159a13aa3f8f0c9f5cf0c3bc9700e20911f261dbfc7f2
Opcode Fuzzy Hash: c75cacda880fe9285c632b8e340322e0ab6004410d887ed0a5f5d8ca1c4ca242
Instruction Fuzzy Hash: E2C18971208201AFD710DF28C494F2ABBE5BF85318F14859CF49A8B6A2CB75ED45CBD1

Function 009A255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 009A25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 009A25E8
CreateCompatibleDC.GDI32(?), ref: 009A25F4
SelectObject.GDI32(00000000,?), ref: 009A2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 009A266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 009A26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 009A26D0
SelectObject.GDI32(?,?), ref: 009A26D8
DeleteObject.GDI32(?), ref: 009A26E1
DeleteDC.GDI32(?), ref: 009A26E8
ReleaseDC.USER32(00000000,?), ref: 009A26F3

Strings

(, xrefs: 009A268D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 1aba88e8dfdb9ae89f52536fc801a84428b589129d9cdd533cca7f47ff44cffe
Instruction ID: 66831090ab7ee998061eaa673ca0051590db73bd294739206a61903f64aedf5d
Opcode Fuzzy Hash: 1aba88e8dfdb9ae89f52536fc801a84428b589129d9cdd533cca7f47ff44cffe
Instruction Fuzzy Hash: E561F2B5D04219EFCF04CFA8D984EAEBBB5FF48310F20852AE955A7250D770A941DFA0

Function 0095DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0095DAA1

Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D659
Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D66B
Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D67D
Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D68F
Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D6A1
Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D6B3
Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D6C5
Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D6D7
Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D6E9
Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D6FB
Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D70D
Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D71F
Part of subcall function 0095D63C: _free.LIBCMT ref: 0095D731

_free.LIBCMT ref: 0095DA96

Part of subcall function 009529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0095D7D1,00000000,00000000,00000000,00000000,?,0095D7F8,00000000,00000007,00000000,?,0095DBF5,00000000), ref: 009529DE
Part of subcall function 009529C8: GetLastError.KERNEL32(00000000,?,0095D7D1,00000000,00000000,00000000,00000000,?,0095D7F8,00000000,00000007,00000000,?,0095DBF5,00000000,00000000), ref: 009529F0

_free.LIBCMT ref: 0095DAB8
_free.LIBCMT ref: 0095DACD
_free.LIBCMT ref: 0095DAD8
_free.LIBCMT ref: 0095DAFA
_free.LIBCMT ref: 0095DB0D
_free.LIBCMT ref: 0095DB1B
_free.LIBCMT ref: 0095DB26
_free.LIBCMT ref: 0095DB5E
_free.LIBCMT ref: 0095DB65
_free.LIBCMT ref: 0095DB82
_free.LIBCMT ref: 0095DB9A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: c970ad8d3c1cd353ab9bd4c43390ec3838cf4e3bd502bfceef0e37f1e96ad414
Instruction ID: 6ee393736e2073ff56d243ce9daa4746fc0939070bd6774cc2cd80b5046df144
Opcode Fuzzy Hash: c970ad8d3c1cd353ab9bd4c43390ec3838cf4e3bd502bfceef0e37f1e96ad414
Instruction Fuzzy Hash: FB3148316053049FEB32EB3AE945B9A77E9FF41312F114419E848E7291DB31AC88C720

Function 0098365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0098369C
_wcslen.LIBCMT ref: 009836A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00983797
GetClassNameW.USER32(?,?,00000400), ref: 0098380C
GetDlgCtrlID.USER32(?), ref: 0098385D
GetWindowRect.USER32(?,?), ref: 00983882
GetParent.USER32(?), ref: 009838A0
ScreenToClient.USER32(00000000), ref: 009838A7
GetClassNameW.USER32(?,?,00000100), ref: 00983921
GetWindowTextW.USER32(?,?,00000400), ref: 0098395D

Strings

%s%u, xrefs: 00983734

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 9f695609cfaf554dff76225ba64ffadf95f15d2c2a0313513208d2f189f9960c
Instruction ID: 10541068fa01092f9fd750c4f1e3d0238f49bb7752efba0802cff653b1f72b43
Opcode Fuzzy Hash: 9f695609cfaf554dff76225ba64ffadf95f15d2c2a0313513208d2f189f9960c
Instruction Fuzzy Hash: 9891C571204606EFD719EF64C885FAAF7ACFF44750F008629F999D2290DB31EA45CB91

Function 00984954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00984994
GetWindowTextW.USER32(?,?,00000400), ref: 009849DA
_wcslen.LIBCMT ref: 009849EB
CharUpperBuffW.USER32(?,00000000), ref: 009849F7
_wcsstr.LIBVCRUNTIME ref: 00984A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00984A64
GetWindowTextW.USER32(?,?,00000400), ref: 00984A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00984AE6
GetClassNameW.USER32(?,?,00000400), ref: 00984B20
GetWindowRect.USER32(?,?), ref: 00984B8B

Strings

ThumbnailClass, xrefs: 00984A6F, 00984AF1

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 8addf9bd693cf76bad82d6085d6e5db338c752a9dd01f508e6ce9cef84f330a1
Instruction ID: e6f8917f291c7120a1a3d8283acef07d734ca8337f4aad9462060247c5d95c8b
Opcode Fuzzy Hash: 8addf9bd693cf76bad82d6085d6e5db338c752a9dd01f508e6ce9cef84f330a1
Instruction Fuzzy Hash: 6591D2710082069FDB04EF54C985FAA77ECFF84314F04846AFD869A296EB34ED45CBA1

Function 0098BF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(009F1990,000000FF,00000000,00000030), ref: 0098BFAC
SetMenuItemInfoW.USER32(009F1990,00000004,00000000,00000030), ref: 0098BFE1
Sleep.KERNEL32(000001F4), ref: 0098BFF3
GetMenuItemCount.USER32(?), ref: 0098C039
GetMenuItemID.USER32(?,00000000), ref: 0098C056
GetMenuItemID.USER32(?,-00000001), ref: 0098C082
GetMenuItemID.USER32(?,?), ref: 0098C0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0098C10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0098C124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0098C145

Strings

0, xrefs: 0098BF3D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 1b30e676cec7f5cc949a6445f9d505793849a49d3bf7b9d1541dc0de70050706
Instruction ID: e4ad145174b5ca6dead80666223aa8f7db9dee9cebc0f82cbc3e2b9f4567b7b1
Opcode Fuzzy Hash: 1b30e676cec7f5cc949a6445f9d505793849a49d3bf7b9d1541dc0de70050706
Instruction Fuzzy Hash: 8A619DF091824AAFDF21EF64DD88EAEBBA8EB45354F040115F911A3392C775AD04DB70

Function 009ACC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 009ACC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 009ACC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 009ACD48

Part of subcall function 009ACC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 009ACCAA
Part of subcall function 009ACC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 009ACCBD
Part of subcall function 009ACC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 009ACCCF
Part of subcall function 009ACC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 009ACD05
Part of subcall function 009ACC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 009ACD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 009ACCF3

Strings

RegDeleteKeyExW, xrefs: 009ACCC9
advapi32.dll, xrefs: 009ACCB8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 355fbcbcffde7d7dbd82f999af129744a8847de90d9e48b60bcd8094863d4714
Instruction ID: 2c0b62a4fa9377ccb91bf95bb35e2ba093cbf48d6b9832799ffe2d5826d4713e
Opcode Fuzzy Hash: 355fbcbcffde7d7dbd82f999af129744a8847de90d9e48b60bcd8094863d4714
Instruction Fuzzy Hash: 78319AB1901128BBDB209B95DD88EFFBB7CEF42760F000565F906E6240DB748A45AAE0

Function 00993D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00993D40
_wcslen.LIBCMT ref: 00993D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00993D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00993DBE
RemoveDirectoryW.KERNEL32(?), ref: 00993DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00993E55
CloseHandle.KERNEL32(00000000), ref: 00993E60
CloseHandle.KERNEL32(00000000), ref: 00993E6B

Strings

\, xrefs: 00993D77
\??\%s, xrefs: 00993D5B
:, xrefs: 00993D82

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: a62301a0cafaa145455b53c44f4b31be05b459f97895fbf036f478c77e82e2e6
Instruction ID: 3ecc64bbdc223ec301042368bd0434e766c65754f690620dd3ab6c7377af0156
Opcode Fuzzy Hash: a62301a0cafaa145455b53c44f4b31be05b459f97895fbf036f478c77e82e2e6
Instruction Fuzzy Hash: C631AFB6914209ABDF219FA4DC49FEB37BCEF88710F1081B5F619D60A0EB7497448B24

Function 0098E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0098E6B4

Part of subcall function 0093E551: timeGetTime.WINMM(?,?,0098E6D4), ref: 0093E555

Sleep.KERNEL32(0000000A), ref: 0098E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0098E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0098E727
SetActiveWindow.USER32 ref: 0098E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0098E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0098E773
Sleep.KERNEL32(000000FA), ref: 0098E77E
IsWindow.USER32 ref: 0098E78A
EndDialog.USER32(00000000), ref: 0098E79B

Strings

BUTTON, xrefs: 0098E719

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 1651a7589062238184b6f26bef32347d41ad5234a7aa7e69e02b9460e4308636
Instruction ID: 81428ec30e638a2e82eb1bad5705e17863d3ef190ea4d9cd524d206470deee32
Opcode Fuzzy Hash: 1651a7589062238184b6f26bef32347d41ad5234a7aa7e69e02b9460e4308636
Instruction Fuzzy Hash: 0C216DB0228205AFEB106F20EDD9F3A3B69F754B59B100526F401C22B1DBB1AC00EB64

Function 0098E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0098EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0098EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0098EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0098EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0098EAA7

Strings

alias PlayMe, xrefs: 0098EA36
status PlayMe mode, xrefs: 0098EA58
play PlayMe wait, xrefs: 0098EA91
close PlayMe, xrefs: 0098EA6E, 0098EA9B
open , xrefs: 0098EA0C
play PlayMe, xrefs: 0098EAA2

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 9728bf620d0ebc783dfd9c63f7077c3392006483b929452825073508f0009ea8
Instruction ID: 10be15cb5327163a9ad57c32906c1bf91ebc1807332e3319b4810c1003d4019c
Opcode Fuzzy Hash: 9728bf620d0ebc783dfd9c63f7077c3392006483b929452825073508f0009ea8
Instruction Fuzzy Hash: 4C118631A5026979D725F7A6EC5AEFF6A7CEBE1F44F400429B801A20D5EF700E45C6B0

Function 00989F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 0098A012
SetKeyboardState.USER32(?), ref: 0098A07D
GetAsyncKeyState.USER32(000000A0), ref: 0098A09D
GetKeyState.USER32(000000A0), ref: 0098A0B4
GetAsyncKeyState.USER32(000000A1), ref: 0098A0E3
GetKeyState.USER32(000000A1), ref: 0098A0F4
GetAsyncKeyState.USER32(00000011), ref: 0098A120
GetKeyState.USER32(00000011), ref: 0098A12E
GetAsyncKeyState.USER32(00000012), ref: 0098A157
GetKeyState.USER32(00000012), ref: 0098A165
GetAsyncKeyState.USER32(0000005B), ref: 0098A18E
GetKeyState.USER32(0000005B), ref: 0098A19C

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 84b2c690eae22cb2090be0601ff63de2d8c4d91a5ed828f76786397f0c31090f
Instruction ID: 12bfd4472e2f4ac2abbc77632ba4c6dae360afe2c8d733b61a00d186568c6b0c
Opcode Fuzzy Hash: 84b2c690eae22cb2090be0601ff63de2d8c4d91a5ed828f76786397f0c31090f
Instruction Fuzzy Hash: 87519A2090879829FB35FB6089557FABFB99F12380F0C459AD5C2573C2EA54AE4CC762

Function 00985CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00985CE2
GetWindowRect.USER32(00000000,?), ref: 00985CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00985D59
GetDlgItem.USER32(?,00000002), ref: 00985D69
GetWindowRect.USER32(00000000,?), ref: 00985D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00985DCF
GetDlgItem.USER32(?,000003E9), ref: 00985DDD
GetWindowRect.USER32(00000000,?), ref: 00985DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00985E31
GetDlgItem.USER32(?,000003EA), ref: 00985E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00985E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00985E67

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 2400a85e72d08335897d7f6ee6d1eec2330c177dc1670281f4958e737cb8baa6
Instruction ID: 32fc6cb67e944198e428feb5caee3ee552ea9bbd37e67b08f4827e699a0d4362
Opcode Fuzzy Hash: 2400a85e72d08335897d7f6ee6d1eec2330c177dc1670281f4958e737cb8baa6
Instruction Fuzzy Hash: 485111B1B10609AFDF18DF68DD89AAE7BB9FB48310F158229F915E7290D7709D04CB50

Function 00938BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00938F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00938BE8,?,00000000,?,?,?,?,00938BBA,00000000,?), ref: 00938FC5

DestroyWindow.USER32(?), ref: 00938C81
KillTimer.USER32(00000000,?,?,?,?,00938BBA,00000000,?), ref: 00938D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00976973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00938BBA,00000000,?), ref: 009769A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00938BBA,00000000,?), ref: 009769B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00938BBA,00000000), ref: 009769D4
DeleteObject.GDI32(00000000), ref: 009769E6

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 3b7c81e695bc82cec0a699c3324f2d8b0bd6731fac4d58ddab4ddf5746767f6b
Instruction ID: da2fd949bd04981b658fe68e7dac6cca3e865759da8bc851177614acc396a37b
Opcode Fuzzy Hash: 3b7c81e695bc82cec0a699c3324f2d8b0bd6731fac4d58ddab4ddf5746767f6b
Instruction Fuzzy Hash: EC616B71516B00DFCB299F25DA48B3677F5FB50312F14991CE086A65A0CB75AD80EFA0

Function 00939838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00939944: GetWindowLongW.USER32(?,000000EB), ref: 00939952

GetSysColor.USER32(0000000F), ref: 00939862

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 6b9b712651936fc5dc903e7aa66db7b84ab9efe74c10681d1d72ebf8b84a6be8
Instruction ID: 91914b306c775853b0fcdb846a94e22dedd0d9462c99ebcbb68d877c14e494a3
Opcode Fuzzy Hash: 6b9b712651936fc5dc903e7aa66db7b84ab9efe74c10681d1d72ebf8b84a6be8
Instruction Fuzzy Hash: 4F41B471108644AFDB205F7C9C84BBA7BA9EB87330F144619F9A6972E1D7B19C41EF10

Function 009896E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0096F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00989717
LoadStringW.USER32(00000000,?,0096F7F8,00000001), ref: 00989720

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0096F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00989742
LoadStringW.USER32(00000000,?,0096F7F8,00000001), ref: 00989745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00989866

Strings

^ ERROR, xrefs: 009897FB
Line %d:, xrefs: 009897A0
Error: , xrefs: 0098981D
Line %d (File "%s"):, xrefs: 0098978F
%s (%d) : ==> %s: %s %s, xrefs: 0098984A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: bc4d17cb9fd920a24b9dbc04f34dbe7e899384d2073457f1d1c74dbd3f7eb644
Instruction ID: 4676d51c4c6c7ad3cb94d637bf9abeec3e6765ed9a9503e499c49704f1d6067d
Opcode Fuzzy Hash: bc4d17cb9fd920a24b9dbc04f34dbe7e899384d2073457f1d1c74dbd3f7eb644
Instruction Fuzzy Hash: 6D416D72804219AACF05FBE0EE86FEEB778AF94340F544425F20572196EB356F48CB61

Function 009806DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00926B57: _wcslen.LIBCMT ref: 00926B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 009807A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 009807BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 009807DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00980804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0098082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00980837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0098083C

Strings

\CLSID, xrefs: 00980724
SOFTWARE\Classes\, xrefs: 0098070E
\IPC$, xrefs: 00980784

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 37e846ee3cd4a388b28e2bfa23189d04ca9b7effb0fcfb88d3af45762d8ea165
Instruction ID: 71ab80757ab1d508fec668d6d696156bf9117c637426fa1d4c1ea1e177d516ba
Opcode Fuzzy Hash: 37e846ee3cd4a388b28e2bfa23189d04ca9b7effb0fcfb88d3af45762d8ea165
Instruction Fuzzy Hash: 54410872C14229AFDF15EFA4EC95DEDB778BF84750F454129E901A3161EB309E48CBA0

Function 009B3F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 009B403B
CreateCompatibleDC.GDI32(00000000), ref: 009B4042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 009B4055
SelectObject.GDI32(00000000,00000000), ref: 009B405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 009B4068
DeleteDC.GDI32(00000000), ref: 009B4072
GetWindowLongW.USER32(?,000000EC), ref: 009B407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 009B4092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 009B409E

Strings

static, xrefs: 009B3FD3

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: e023aa4abd3dfb23eece86d6d9bd90ba52cedd84627cbc476a68ba6d17b8bdca
Instruction ID: 5a2b9fbac9d78a5c3722d712c38839b328729efc9c43010cc12bdafac6bf2e96
Opcode Fuzzy Hash: e023aa4abd3dfb23eece86d6d9bd90ba52cedd84627cbc476a68ba6d17b8bdca
Instruction Fuzzy Hash: 8A316972515219ABDF21AFA8CE08FEA3B6CEF0D734F000311FA14A61A1C775D810EBA0

Function 009A3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009A3C5C
CoInitialize.OLE32(00000000), ref: 009A3C8A
CoUninitialize.OLE32 ref: 009A3C94
_wcslen.LIBCMT ref: 009A3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 009A3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 009A3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 009A3F0E
CoGetObject.OLE32(?,00000000,009BFB98,?), ref: 009A3F2D
SetErrorMode.KERNEL32(00000000), ref: 009A3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 009A3FC4
VariantClear.OLEAUT32(?), ref: 009A3FD8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 5fb33f8f887d09225c4e5bb87f534c902b5da3016b7a013c89f0fa08d75fbb6f
Instruction ID: 2c061cab4ac0cd199c7b3e17b2fd584de986b003b1fb59413a14716ccfd5fdc3
Opcode Fuzzy Hash: 5fb33f8f887d09225c4e5bb87f534c902b5da3016b7a013c89f0fa08d75fbb6f
Instruction Fuzzy Hash: 88C146B16083059FD700DF68C98492BBBE9FF8A754F10891DF98A9B250D731EE05CB92

Function 00997A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00997AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00997B8F
SHGetDesktopFolder.SHELL32(?), ref: 00997BA3
CoCreateInstance.OLE32(009BFD08,00000000,00000001,009E6E6C,?), ref: 00997BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00997C74
CoTaskMemFree.OLE32(?,?), ref: 00997CCC
SHBrowseForFolderW.SHELL32(?), ref: 00997D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00997D7A
CoTaskMemFree.OLE32(00000000), ref: 00997D81
CoTaskMemFree.OLE32(00000000), ref: 00997DD6
CoUninitialize.OLE32 ref: 00997DDC

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 8b9e565d0eb2471671d5f12c80f837f30d0def0363d7e779119ccb57306ea86a
Instruction ID: 1c7f6e7f40d3a8b7c625ba4958ccd9392ab9e194ffbcf7acec6d328b594bfc5f
Opcode Fuzzy Hash: 8b9e565d0eb2471671d5f12c80f837f30d0def0363d7e779119ccb57306ea86a
Instruction Fuzzy Hash: C5C12B75A14119AFCB14DFA8C884DAEBBF9FF48314B148599F8199B361DB30EE41CB90

Function 009B541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 009B5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 009B5515
CharNextW.USER32(00000158), ref: 009B5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 009B5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 009B559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 009B55AC

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 45c0d653edccb69c892ff019a14e8676b7ee2e49886fe8d1d1c9c1eea14b49e2
Instruction ID: 2a46159deeac33d2249a2de70cee88845155945610f621c84357f3dd3bf44013
Opcode Fuzzy Hash: 45c0d653edccb69c892ff019a14e8676b7ee2e49886fe8d1d1c9c1eea14b49e2
Instruction Fuzzy Hash: 1A619E70904609EFDF209F94CE88FFE7BB9EB09731F114549F525A62A0D7748A80DB60

Function 0097FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0097FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0097FB08
VariantInit.OLEAUT32(?), ref: 0097FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0097FB3A
VariantCopy.OLEAUT32(?,?), ref: 0097FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0097FBA1
VariantClear.OLEAUT32(?), ref: 0097FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0097FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0097FBCC
VariantClear.OLEAUT32(?), ref: 0097FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0097FBE9

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: a8eec4e9cf2b6beea88d7a5c3cab803794a15f9eec4d349a170f1c6881c599c0
Instruction ID: 4c8acbc596ead9daeb5032fd30c269ccd2a3494a763c6de26b8ac8bc67da2735
Opcode Fuzzy Hash: a8eec4e9cf2b6beea88d7a5c3cab803794a15f9eec4d349a170f1c6881c599c0
Instruction Fuzzy Hash: 72417275A04219DFCB00DF64D8649AEBBB9FF48354F008469E959A7261DB30AA45CFA0

Function 00989C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00989CA1
GetAsyncKeyState.USER32(000000A0), ref: 00989D22
GetKeyState.USER32(000000A0), ref: 00989D3D
GetAsyncKeyState.USER32(000000A1), ref: 00989D57
GetKeyState.USER32(000000A1), ref: 00989D6C
GetAsyncKeyState.USER32(00000011), ref: 00989D84
GetKeyState.USER32(00000011), ref: 00989D96
GetAsyncKeyState.USER32(00000012), ref: 00989DAE
GetKeyState.USER32(00000012), ref: 00989DC0
GetAsyncKeyState.USER32(0000005B), ref: 00989DD8
GetKeyState.USER32(0000005B), ref: 00989DEA

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 90393e65f4b4e8ed12d67c674dfce4278a443a50d897e7d7b1ca23b91e13f45e
Instruction ID: dda8ed2fc21176c6c383b99aa3f441ddb5744364c12a3dc0419db7715698c62d
Opcode Fuzzy Hash: 90393e65f4b4e8ed12d67c674dfce4278a443a50d897e7d7b1ca23b91e13f45e
Instruction Fuzzy Hash: 0441FA746087CA6DFF30A760C8043B5BEE86F11344F0C805AEAC6567C2DBE599C8C7A6

Function 009A055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 009A05BC
inet_addr.WSOCK32(?), ref: 009A061C
gethostbyname.WSOCK32(?), ref: 009A0628
IcmpCreateFile.IPHLPAPI ref: 009A0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 009A06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 009A06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 009A07B9
WSACleanup.WSOCK32 ref: 009A07BF

Strings

Ping, xrefs: 009A0676

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: df730166d22971c56c1ac1f3ab48e65f4431109acc7988b51df322952dc3c065
Instruction ID: 38aa70f8122a04128452800f9cf340d359d5ca943d2a214c059a04ce2068b292
Opcode Fuzzy Hash: df730166d22971c56c1ac1f3ab48e65f4431109acc7988b51df322952dc3c065
Instruction Fuzzy Hash: 1A919E755082019FD320CF15D989F1ABBE4AF89318F1489A9F4699B6A2C730FD45CFD1

Function 009A8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 009A8CF3

Part of subcall function 00988E54: _wcslen.LIBCMT ref: 00988E77

_wcslen.LIBCMT ref: 009A8D4E
_wcslen.LIBCMT ref: 009A8D9C
_wcslen.LIBCMT ref: 009A8DDC
_wcslen.LIBCMT ref: 009A8E6E

Strings

stdcall, xrefs: 009A8DD6, 009A8DDB
winapi, xrefs: 009A8D96, 009A8D9B
cdecl, xrefs: 009A8D48, 009A8D4D
none, xrefs: 009A8E65, 009A8E6A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 5b17665d45e7833ff688f671a7c9bb68c6146b1fa080515b3db6e897df917d58
Instruction ID: 492ef2720ddd70ca55d99b6f9996e903463db69f139896e890bde72eb2ffa012
Opcode Fuzzy Hash: 5b17665d45e7833ff688f671a7c9bb68c6146b1fa080515b3db6e897df917d58
Instruction Fuzzy Hash: F1519031A00116DBCF24EF68C9409BFB7A9BF66764B204629E426E72C4DB34DD41C7D0

Function 009A372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 009A3774
CoUninitialize.OLE32 ref: 009A377F
CoCreateInstance.OLE32(?,00000000,00000017,009BFB78,?), ref: 009A37D9
IIDFromString.OLE32(?,?), ref: 009A384C
VariantInit.OLEAUT32(?), ref: 009A38E4
VariantClear.OLEAUT32(?), ref: 009A3936

Strings

Failed to create object, xrefs: 009A37E4, 009A389A
NULL Pointer assignment, xrefs: 009A381E
Invalid parameter, xrefs: 009A3865

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 72b0a4c2ff83c315915a2503bce546c039598f70742f8499a788881fdf97c2ca
Instruction ID: 42c7b9b5de5e8c653f405932bcf3fe4703d15da6f52b1a82a2dea6433665c790
Opcode Fuzzy Hash: 72b0a4c2ff83c315915a2503bce546c039598f70742f8499a788881fdf97c2ca
Instruction Fuzzy Hash: 2161C0B0608311AFD311DF58D848F6AB7E8EF8A714F108909F9859B291D774EE48CBD2

Function 00993388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 009933CF

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 009933F0

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00993504
Error: , xrefs: 009934D1
Incorrect parameters to object property !, xrefs: 009934AB
Line %d (File "%s"):, xrefs: 00993443, 0099345C
^ ERROR , xrefs: 0099349E
"%s" (%d) : ==> %s:, xrefs: 00993522

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: c7b9c0ed684a4ddc71d83e660b00558d7234f833cb2963c4801d4df1b736920a
Instruction ID: c3d4781d17d61558a234d73f0073dc4832dd5eb04bbc994e470012bec3547882
Opcode Fuzzy Hash: c7b9c0ed684a4ddc71d83e660b00558d7234f833cb2963c4801d4df1b736920a
Instruction Fuzzy Hash: 5A51A072C00219AADF15EBA0DD42FEEB778AF98344F148465F009720A1EB756F58DB61

Function 0098B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0098B5FC
_wcslen.LIBCMT ref: 0098B608
_wcslen.LIBCMT ref: 0098B64D
_wcslen.LIBCMT ref: 0098B68C
_wcslen.LIBCMT ref: 0098B6C7

Strings

APPEND, xrefs: 0098B6C1, 0098B6C6
KEYS, xrefs: 0098B647, 0098B64C
REMOVE, xrefs: 0098B602, 0098B607
EXISTS, xrefs: 0098B686, 0098B68B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: c35fca39e7d40bd42591b446910d103319a2f41a61cba561c881e4f50deca194
Instruction ID: 65ce7ee5c8774a3550e05cf6ab740825c85f511c1be6ffd985fe6e1419b10493
Opcode Fuzzy Hash: c35fca39e7d40bd42591b446910d103319a2f41a61cba561c881e4f50deca194
Instruction Fuzzy Hash: F141A732A001279BCB207F7D89905BE77A9BFA0BB4B294529E521DB384F735CD81C790

Function 00995393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 009953A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00995416
GetLastError.KERNEL32 ref: 00995420
SetErrorMode.KERNEL32(00000000,READY), ref: 009954A7

Strings

UNKNOWN, xrefs: 00995444
READY, xrefs: 00995460, 00995468
READONLY, xrefs: 00995452
NOTREADY, xrefs: 0099544B
INVALID, xrefs: 00995459

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 4092555c51a09dc4127c9cc547112d9eb15874bcd3a46cc5e9da361c98092a87
Instruction ID: e6c0a1ea6d868c7b1ea15b5575cb365aff42545dcf12f78f5a0fb532a28bfee0
Opcode Fuzzy Hash: 4092555c51a09dc4127c9cc547112d9eb15874bcd3a46cc5e9da361c98092a87
Instruction Fuzzy Hash: EA31C175A006089FCB52DF6DC888BAABBF8FF54305F158069E405DB2A2D730DD82CB90

Function 009B3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 009B3C79
SetMenu.USER32(?,00000000), ref: 009B3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 009B3D10
IsMenu.USER32(?), ref: 009B3D24
CreatePopupMenu.USER32 ref: 009B3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 009B3D5B
DrawMenuBar.USER32 ref: 009B3D63

Strings

F, xrefs: 009B3D4E
0, xrefs: 009B3C54

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 56dd6d18e55d25f9d4964a6737c9e7c1ef6ddb0350d26cf82c09af8902e6693c
Instruction ID: 2a5b572fb40dea0be2755773cdf82d1a89d06aa1f287384eac8154c60de4ef2a
Opcode Fuzzy Hash: 56dd6d18e55d25f9d4964a6737c9e7c1ef6ddb0350d26cf82c09af8902e6693c
Instruction Fuzzy Hash: 99419E75A05209EFDB24CF64D944EEA7BB9FF89320F144129F946973A0D770AA10DF90

Function 00981EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

Part of subcall function 00983CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00983CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00981F64
GetDlgCtrlID.USER32 ref: 00981F6F
GetParent.USER32 ref: 00981F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00981F8E
GetDlgCtrlID.USER32(?), ref: 00981F97
GetParent.USER32(?), ref: 00981FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00981FAE

Strings

ListBox, xrefs: 00981F21
ComboBox, xrefs: 00981EEC

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 3461bbe49507ba85a82db310f0c59eb2ec98c1d791438c5958ed627b16549343
Instruction ID: 6676bf3bf4bb13ec8193234237a91db4a47dd8a9649b4b94c6a5910e39a4a1ba
Opcode Fuzzy Hash: 3461bbe49507ba85a82db310f0c59eb2ec98c1d791438c5958ed627b16549343
Instruction Fuzzy Hash: 2F21C2B4D00214FBCF05AFA0DC85EEEBBB8EF49310F004215FA6567291DB785905DB60

Function 00981FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

Part of subcall function 00983CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00983CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00982043
GetDlgCtrlID.USER32 ref: 0098204E
GetParent.USER32 ref: 0098206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0098206D
GetDlgCtrlID.USER32(?), ref: 00982076
GetParent.USER32(?), ref: 0098208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0098208D

Strings

ListBox, xrefs: 00982002
ComboBox, xrefs: 00981FCD

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 156b23097e191f45d9b1e6ea761c976825531fb10b603599faf8bbe63d7ed39f
Instruction ID: 85b026677f749510a1dd87ba24d771f3c3190bf474756a57a3600de7f8c363d7
Opcode Fuzzy Hash: 156b23097e191f45d9b1e6ea761c976825531fb10b603599faf8bbe63d7ed39f
Instruction Fuzzy Hash: 0721D1B5D00218BBCF10BFA0DC89EEEBBB8EF09310F004416F995A72A1DA794914DB60

Function 009B3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 009B3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 009B3AA0
GetWindowLongW.USER32(?,000000F0), ref: 009B3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 009B3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 009B3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 009B3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 009B3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 009B3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 009B3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 009B3C13

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 7ab2c683a28dc0ca6981e16f65edd266c1c8964ce4e80f4861ba31939c2ef21a
Instruction ID: 8dd927039d7de5b2ab7af8274d1ea6e990113d2f9856fc96aaf0abe0991c8687
Opcode Fuzzy Hash: 7ab2c683a28dc0ca6981e16f65edd266c1c8964ce4e80f4861ba31939c2ef21a
Instruction Fuzzy Hash: 64619975A00258AFDB10DFA8CD81EFE77B8EB49710F104199FA15A72A1C770AE81DB90

Function 0098B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0098B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0098A1E1,?,00000001), ref: 0098B165
GetWindowThreadProcessId.USER32(00000000), ref: 0098B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0098A1E1,?,00000001), ref: 0098B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0098B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0098A1E1,?,00000001), ref: 0098B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0098A1E1,?,00000001), ref: 0098B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0098A1E1,?,00000001), ref: 0098B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0098A1E1,?,00000001), ref: 0098B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0098A1E1,?,00000001), ref: 0098B21D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 335e26a1a88dbb312d7e5663638281efdf75a4f082982fab399c6bcbb00e9f87
Instruction ID: 04d1177080241e6f705636778dcb4ef4699b943d5bcca6fb629d27622afbc705
Opcode Fuzzy Hash: 335e26a1a88dbb312d7e5663638281efdf75a4f082982fab399c6bcbb00e9f87
Instruction Fuzzy Hash: 493193B1528204FFDB10AF24DD48F7D7BADBB61321F188116F911D6290DBB8A940DF64

Function 00952C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00952C94

Part of subcall function 009529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0095D7D1,00000000,00000000,00000000,00000000,?,0095D7F8,00000000,00000007,00000000,?,0095DBF5,00000000), ref: 009529DE
Part of subcall function 009529C8: GetLastError.KERNEL32(00000000,?,0095D7D1,00000000,00000000,00000000,00000000,?,0095D7F8,00000000,00000007,00000000,?,0095DBF5,00000000,00000000), ref: 009529F0

_free.LIBCMT ref: 00952CA0
_free.LIBCMT ref: 00952CAB
_free.LIBCMT ref: 00952CB6
_free.LIBCMT ref: 00952CC1
_free.LIBCMT ref: 00952CCC
_free.LIBCMT ref: 00952CD7
_free.LIBCMT ref: 00952CE2
_free.LIBCMT ref: 00952CED
_free.LIBCMT ref: 00952CFB

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8bcc226e06ed14f89337c9f1187f86533454d23ac23d149ac3976b15441247cd
Instruction ID: 4b42e999598cbfa1981a82838552a20a357e7a3ccd62b6be0dbec6e3f8b9d825
Opcode Fuzzy Hash: 8bcc226e06ed14f89337c9f1187f86533454d23ac23d149ac3976b15441247cd
Instruction Fuzzy Hash: 4A11D776100108AFCB02EF56D952EDD3BA5FF46351F4144A4FD486F322D631EE549B90

Function 00921410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00921459
OleUninitialize.OLE32(?,00000000), ref: 009214F8
UnregisterHotKey.USER32(?), ref: 009216DD
DestroyWindow.USER32(?), ref: 009624B9
FreeLibrary.KERNEL32(?), ref: 0096251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0096254B

Strings

close all, xrefs: 00921454

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 140ab0254b9c1302022325fc3e0df51efe638ff6d1f4640bdad69e361ecf4e53
Instruction ID: d62c38d0834c3d36dba265a90accd415c23ebc0bafead101ad8a573f6533d055
Opcode Fuzzy Hash: 140ab0254b9c1302022325fc3e0df51efe638ff6d1f4640bdad69e361ecf4e53
Instruction Fuzzy Hash: 31D19D71701222CFDB29EF14D999B29F7A4BF55710F2442ADE44A6B265CB30ED22CF90

Function 00997DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00997FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00997FC1
GetFileAttributesW.KERNEL32(?), ref: 00997FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00998005
SetCurrentDirectoryW.KERNEL32(?), ref: 00998017
SetCurrentDirectoryW.KERNEL32(?), ref: 00998060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 009980B0

Strings

*.*, xrefs: 00998066

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 63ba97e93cafd1b4f8be668a760d9ac722bf835224270f3f00f4b2078ec9a05e
Instruction ID: e9da3a94f09cf86a7812a549586e18c936a71aaf55e0fcf090c56f4758385b3e
Opcode Fuzzy Hash: 63ba97e93cafd1b4f8be668a760d9ac722bf835224270f3f00f4b2078ec9a05e
Instruction Fuzzy Hash: 4281AF725182019BCF20EF98C844AAEF3E8BF99310F544C6EF885D7260EB34DD458B92

Function 00925BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00925C7A

Part of subcall function 00925D0A: GetClientRect.USER32(?,?), ref: 00925D30
Part of subcall function 00925D0A: GetWindowRect.USER32(?,?), ref: 00925D71
Part of subcall function 00925D0A: ScreenToClient.USER32(?,?), ref: 00925D99

GetDC.USER32 ref: 009646F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00964708
SelectObject.GDI32(00000000,00000000), ref: 00964716
SelectObject.GDI32(00000000,00000000), ref: 0096472B
ReleaseDC.USER32(?,00000000), ref: 00964733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 009647C4

Strings

U, xrefs: 00964693

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 7ef18bb88c2689bfc9fad70509ebfc68e0d62dfbf942790e8d8dae986453e43e
Instruction ID: b797a1225444592842f666f20493f7838d097d848f827aaccb02e022cdadf834
Opcode Fuzzy Hash: 7ef18bb88c2689bfc9fad70509ebfc68e0d62dfbf942790e8d8dae986453e43e
Instruction Fuzzy Hash: DF710430404205DFCF21CFA4CA84AFA3BB9FF8A364F144269ED555A1AAD7309C91DF50

Function 0099359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 009935E4

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

LoadStringW.USER32(009F2390,?,00000FFF,?), ref: 0099360A

Strings

^ ERROR, xrefs: 009936C9
"%s" (%d) : ==> %s:%s%s, xrefs: 00993724
Error: , xrefs: 009936EF
Line %d (File "%s"):, xrefs: 0099366B
"%s" (%d) : ==> %s:, xrefs: 00993742

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: bd5c521849243de041a31dcecd6c9e6162eaa9eb41a66694e5ba7c423b7555ed
Instruction ID: de0f3c17a0949cc83e1adbe23e85d374706d1cb2bd87b17dc385217cc35e706f
Opcode Fuzzy Hash: bd5c521849243de041a31dcecd6c9e6162eaa9eb41a66694e5ba7c423b7555ed
Instruction Fuzzy Hash: 5B515D7280021AAADF15EFE0DC42FEDBB78AF94344F148125F105721A5EB715B98DFA1

Function 0099C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0099C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0099C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0099C2CA
GetLastError.KERNEL32 ref: 0099C322
SetEvent.KERNEL32(?), ref: 0099C336
InternetCloseHandle.WININET(00000000), ref: 0099C341

Strings

, xrefs: 0099C2BB

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 17bfa35085f105819eaa6616a51e0e71eb1a2dfddf3380e15bb2afe05184e203
Instruction ID: ccb0c6c3337e00e71f5ed674943e74f30d7a2ab67ca43da70da2d1566fae8587
Opcode Fuzzy Hash: 17bfa35085f105819eaa6616a51e0e71eb1a2dfddf3380e15bb2afe05184e203
Instruction Fuzzy Hash: 85318CF1604208AFDB219FA8CD89AAB7BFCEB49754F10861EF486D2200DB34DD449B71

Function 0098989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00963AAF,?,?,Bad directive syntax error,009BCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 009898BC
LoadStringW.USER32(00000000,?,00963AAF,?), ref: 009898C3

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00989987

Strings

Line %d:, xrefs: 00989912
., xrefs: 0098996D
%s (%d) : ==> %s.: %s %s, xrefs: 009898F1
Line %d (File "%s"):, xrefs: 0098992D
Error: , xrefs: 00989955

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 8a04f60a8a8c487f3f23be89f78dab6796d412e5e668fdabdae157d0193f12bb
Instruction ID: 399cb8cfad1c0b7a0be9893ba5ef05d554106c33fab9f1100371f11f130c629b
Opcode Fuzzy Hash: 8a04f60a8a8c487f3f23be89f78dab6796d412e5e668fdabdae157d0193f12bb
Instruction Fuzzy Hash: 8C217E31C0021AABCF16EF90DC06FEE7739BF68704F084829F519620A2EB759A18DB50

Function 0098209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 009820AB
GetClassNameW.USER32(00000000,?,00000100), ref: 009820C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0098214D

Strings

smallicons, xrefs: 00982115
details, xrefs: 009820FB
list, xrefs: 0098212F
SHELLDLL_DefView, xrefs: 009820CC
largeicons, xrefs: 009820E1

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: e8e51159e1a9c719b60e13376d3b9a6018fff0bf17721a2527e011b63237d22a
Instruction ID: 4ffc97abe899a9d006022d4500812b55c76fe2de89525539151f24ce9dc0d99c
Opcode Fuzzy Hash: e8e51159e1a9c719b60e13376d3b9a6018fff0bf17721a2527e011b63237d22a
Instruction Fuzzy Hash: 9011C6B668C707BAF7027721DD0AEA6379CDB4572CB310116FB04A52E2FEA5AC415714

Function 00958D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1960cc45caf0606e4d1a4a53af3ce33b2906f04056279c34497835cc14a1589
Instruction ID: 3dc29085bb6e213e60c682bafd8a9145377fcd6b104125d0ab03b8d2ad96bc67
Opcode Fuzzy Hash: f1960cc45caf0606e4d1a4a53af3ce33b2906f04056279c34497835cc14a1589
Instruction Fuzzy Hash: 35C11274A04249EFDF11EFAAC841BAEBBB8AF49311F044499EC15A73D2C7749949CB60

Function 0095CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0095CEB7
_free.LIBCMT ref: 0095CF22
_free.LIBCMT ref: 0095CF48
_free.LIBCMT ref: 0095CF71
_free.LIBCMT ref: 0095CFA9
_free.LIBCMT ref: 0095CFDA
_free.LIBCMT ref: 0095D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0095D09C
_free.LIBCMT ref: 0095D0B5

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 37e4ec1775d1d65bcaa63196c821c7c87507cd508d0133a2b625d894bc0d4bec
Instruction ID: 3baf95ddc2ef423170c6b0d9ad87a806a3c84e7586f933d8b8fae1cf486585ad
Opcode Fuzzy Hash: 37e4ec1775d1d65bcaa63196c821c7c87507cd508d0133a2b625d894bc0d4bec
Instruction Fuzzy Hash: 756107B1908301AFDB21EFB6D891B7E7BADAF85312F04416DFD44A7282D6319D09D750

Function 009B50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 009B5186
ShowWindow.USER32(?,00000000), ref: 009B51C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 009B51CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 009B51D1

Part of subcall function 009B6FBA: DeleteObject.GDI32(00000000), ref: 009B6FE6

GetWindowLongW.USER32(?,000000F0), ref: 009B520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 009B521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 009B524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 009B5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 009B5296

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 6d36b474d3b984e23b6f745c0d4ab00517af620f16960774a6031ecee01f6309
Instruction ID: bf8cfed4694ddfa8e0a7a3b952794ee6434732d83944ba65f5a84fd6441d1dd2
Opcode Fuzzy Hash: 6d36b474d3b984e23b6f745c0d4ab00517af620f16960774a6031ecee01f6309
Instruction Fuzzy Hash: D751D470A5AA08FFEF249F68DE4ABD83B69FB45330F154112F525962E0C7B5E980DB40

Function 00938B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00976890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 009768A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 009768B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 009768D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 009768F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00938874,00000000,00000000,00000000,000000FF,00000000), ref: 00976901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0097691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00938874,00000000,00000000,00000000,000000FF,00000000), ref: 0097692D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 3aab92143e314a96d51781a59b69337c5f4c823a0cf7ce5e56cc62c371627684
Instruction ID: 6b3acd9412d8ce8eb58c88277da9827082f4e35700f0554c99a371dd12a85585
Opcode Fuzzy Hash: 3aab92143e314a96d51781a59b69337c5f4c823a0cf7ce5e56cc62c371627684
Instruction Fuzzy Hash: 87516BB161070AEFDB24CF24CC55FAA7BBAEB48760F104518F956972A0DBB0E990DF50

Function 0099C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0099C182
GetLastError.KERNEL32 ref: 0099C195
SetEvent.KERNEL32(?), ref: 0099C1A9

Part of subcall function 0099C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0099C272
Part of subcall function 0099C253: GetLastError.KERNEL32 ref: 0099C322
Part of subcall function 0099C253: SetEvent.KERNEL32(?), ref: 0099C336
Part of subcall function 0099C253: InternetCloseHandle.WININET(00000000), ref: 0099C341

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: a24d8ac50e0d7a66c0a45c95f76b6aeb3841fb46471fac63581bb9320ee36c71
Instruction ID: 139549dfcae9e1a3af401263a58ee987e0a0559781d348fac3aa5430b1348a46
Opcode Fuzzy Hash: a24d8ac50e0d7a66c0a45c95f76b6aeb3841fb46471fac63581bb9320ee36c71
Instruction Fuzzy Hash: DC318CB1204605BFDF219FA9DD44A6ABBFCFF58310B14451DF96A82610DB30E814ABA0

Function 009825A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00983A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00983A57
Part of subcall function 00983A3D: GetCurrentThreadId.KERNEL32 ref: 00983A5E
Part of subcall function 00983A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009825B3), ref: 00983A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 009825BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 009825DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 009825DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 009825E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00982601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00982605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0098260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00982623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00982627

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 4552d62462188df166bf3b3a8d35e11dda16263e38df3266ab31142469396148
Instruction ID: e893403e173a573c7e60c578b111b2c504cdafdb7a453274a869edca28b16714
Opcode Fuzzy Hash: 4552d62462188df166bf3b3a8d35e11dda16263e38df3266ab31142469396148
Instruction Fuzzy Hash: BA01D4B13A8210BBFB1077689C8EF593F59DB8EB22F100106F358AE1D1C9F224449A69

Function 00981803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00981449,?,?,00000000), ref: 0098180C
HeapAlloc.KERNEL32(00000000,?,00981449,?,?,00000000), ref: 00981813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00981449,?,?,00000000), ref: 00981828
GetCurrentProcess.KERNEL32(?,00000000,?,00981449,?,?,00000000), ref: 00981830
DuplicateHandle.KERNEL32(00000000,?,00981449,?,?,00000000), ref: 00981833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00981449,?,?,00000000), ref: 00981843
GetCurrentProcess.KERNEL32(00981449,00000000,?,00981449,?,?,00000000), ref: 0098184B
DuplicateHandle.KERNEL32(00000000,?,00981449,?,?,00000000), ref: 0098184E
CreateThread.KERNEL32(00000000,00000000,00981874,00000000,00000000,00000000), ref: 00981868

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 15baef5dcd111bf51a53c70c56f16d0dc95ac6c84963fe1f6eea1409b5ffb627
Instruction ID: dd8e9ab8628f0d6af249f83cd64dbda38b1fd7adc7cc41e19e50da78a907b417
Opcode Fuzzy Hash: 15baef5dcd111bf51a53c70c56f16d0dc95ac6c84963fe1f6eea1409b5ffb627
Instruction Fuzzy Hash: 0E01BFB5254304BFE710AFA5DD4DF573BACEB89B11F404511FA05EB191C6709800DB20

Function 009AA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0098D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0098D501
Part of subcall function 0098D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0098D50F
Part of subcall function 0098D4DC: CloseHandle.KERNEL32(00000000), ref: 0098D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 009AA16D
GetLastError.KERNEL32 ref: 009AA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 009AA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 009AA268
GetLastError.KERNEL32(00000000), ref: 009AA273
CloseHandle.KERNEL32(00000000), ref: 009AA2C4

Strings

SeDebugPrivilege, xrefs: 009AA18F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 42ec8ff433647613f8886fb55153e732b4fdfd8b81f180cfa31d84c0461b03b7
Instruction ID: 4ddec498d887bf03cccabc7703074192d28456a42ddfbf795b1a2741eb3765aa
Opcode Fuzzy Hash: 42ec8ff433647613f8886fb55153e732b4fdfd8b81f180cfa31d84c0461b03b7
Instruction Fuzzy Hash: AB618070208242AFD720DF18D494F1ABBE5AF85318F54849CE4668BBA3C776ED45CBD2

Function 009B3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 009B3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 009B393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 009B3954
_wcslen.LIBCMT ref: 009B3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 009B39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 009B39F4

Strings

SysListView32, xrefs: 009B38F7

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: bf94f1a4573a64a1efcf4a6d61e9704a71604061a50a670bbfc06eee8416a7e8
Instruction ID: 869334e57a2b41f0648c4962c07fc06bb82de02341e584e03cce5d509b2dd645
Opcode Fuzzy Hash: bf94f1a4573a64a1efcf4a6d61e9704a71604061a50a670bbfc06eee8416a7e8
Instruction Fuzzy Hash: B8419471A00219EBEF21DF64CD49FEA7BA9EF48364F104526F958E7281D7B19D80CB90

Function 0098BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0098BCFD
IsMenu.USER32(00000000), ref: 0098BD1D
CreatePopupMenu.USER32 ref: 0098BD53
GetMenuItemCount.USER32(01905498), ref: 0098BDA4
InsertMenuItemW.USER32(01905498,?,00000001,00000030), ref: 0098BDCC

Strings

2, xrefs: 0098BD37
0, xrefs: 0098BCA8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 54e7c5fea7dbc656f7075fd1f22676f764892cb37ae8fe7c4f65ba3a5bcc7efb
Instruction ID: 15102d55187a8d25e340c3cb0ee557ff2425e70e1351f30fedcc3b759b8c3deb
Opcode Fuzzy Hash: 54e7c5fea7dbc656f7075fd1f22676f764892cb37ae8fe7c4f65ba3a5bcc7efb
Instruction Fuzzy Hash: 6A51BFB0A04205EBDF20EFA8D884BAEBBF8BF85324F184619F551973D1D7709945CB61

Function 0098C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0098C913

Strings

warning, xrefs: 0098C8FC
question, xrefs: 0098C8CC
blank, xrefs: 0098C895
info, xrefs: 0098C8B4
stop, xrefs: 0098C8E4

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 6d52f38dd72e2c8a53e8f5d261925c27c7104832fe7def198142ef13a058b585
Instruction ID: 8ed8b1c3897b18213b7aaa8ce1e4721d6f5f822d74baddc171f3f75d1c962081
Opcode Fuzzy Hash: 6d52f38dd72e2c8a53e8f5d261925c27c7104832fe7def198142ef13a058b585
Instruction Fuzzy Hash: FE113D72689706BAE7017B149C83EAA279CDF55368B20006FF500A6382E7765E005375

Function 0098DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0098DE42
gethostname.WSOCK32(?,00000100), ref: 0098DE5C
gethostbyname.WSOCK32(?), ref: 0098DE69
inet_ntoa.WSOCK32(?), ref: 0098DEAB
_strcat.LIBCMT ref: 0098DEB9
WSACleanup.WSOCK32 ref: 0098DEDE

Strings

0.0.0.0, xrefs: 0098DE87

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 74f4b31282263f803339f8f426a92d7ca4dbfd68d9fd78c757fbaa462e5dd0d1
Instruction ID: 266138043c47608c311c49c52e8f5250db97b90a64934dc84824475b1a43deb1
Opcode Fuzzy Hash: 74f4b31282263f803339f8f426a92d7ca4dbfd68d9fd78c757fbaa462e5dd0d1
Instruction Fuzzy Hash: 7A112971914104AFCB20BB64DC4AFEF77ACDF90720F0001A9F5459A1D2EF70DA819B60

Function 009B9F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00939BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00939BB2

GetSystemMetrics.USER32(0000000F), ref: 009B9FC7
GetSystemMetrics.USER32(0000000F), ref: 009B9FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 009BA224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 009BA242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 009BA263
ShowWindow.USER32(00000003,00000000), ref: 009BA282
InvalidateRect.USER32(?,00000000,00000001), ref: 009BA2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 009BA2CA

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: eea4a1ba8c71e9d7a41cf71cc29b2dc18b3d49d5d58bc78181535de971f41767
Instruction ID: 134ce91070e63e5e401d6fcb171de90386e8f349d644145acbab10ba8807cb06
Opcode Fuzzy Hash: eea4a1ba8c71e9d7a41cf71cc29b2dc18b3d49d5d58bc78181535de971f41767
Instruction Fuzzy Hash: 0FB19A31604219EFDF14CF68CA857EE7BB6FF44721F088069EC959B295DB31A940CB61

Function 0098ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0098ED2A
_wcslen.LIBCMT ref: 0098ED3B
_wcslen.LIBCMT ref: 0098ED79
_wcslen.LIBCMT ref: 0098EDAF
_wcslen.LIBCMT ref: 0098EDDF
_wcslen.LIBCMT ref: 0098EDEF
_wcslen.LIBCMT ref: 0098EE2B
_wcslen.LIBCMT ref: 0098EE5A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 782a052696b1d686790417d6be98904a7ad5bf7d7697cb834e0c09b2c28a13a5
Instruction ID: 8e72a5ae87ed43578f7ddd7a6834fd570662de30249b0a0780e3623938e90149
Opcode Fuzzy Hash: 782a052696b1d686790417d6be98904a7ad5bf7d7697cb834e0c09b2c28a13a5
Instruction Fuzzy Hash: 00418065C1021875CB11FBB4888AFCFB7A8AF85710F508562E524E3222EB34E255C7A6

Function 0093F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0097682C,00000004,00000000,00000000), ref: 0093F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0097682C,00000004,00000000,00000000), ref: 0097F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0097682C,00000004,00000000,00000000), ref: 0097F454

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: fbdd07ec8422e06edbafff9255304c8517e11a5a94a95a6d06084994081126ef
Instruction ID: 4a99000a542f3d05b16057a0ef2a0a55513c8d73375d03829c7b66951e7524fb
Opcode Fuzzy Hash: fbdd07ec8422e06edbafff9255304c8517e11a5a94a95a6d06084994081126ef
Instruction Fuzzy Hash: 5B413B31A1C640BBC7388B2CC9B877A7B99AF56360F14853CE04B66660C676A880DF51

Function 009B2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 009B2D1B
GetDC.USER32(00000000), ref: 009B2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 009B2D2E
ReleaseDC.USER32(00000000,00000000), ref: 009B2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 009B2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 009B2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,009B5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 009B2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 009B2DE1

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 7b4e157817d55e2442d24516f610c48f57a58faf1471c341945ecc0ca797fe58
Instruction ID: ddb241f7665b352fc64a6a14814acd008a0b63b267e1954fa24a0319873f1624
Opcode Fuzzy Hash: 7b4e157817d55e2442d24516f610c48f57a58faf1471c341945ecc0ca797fe58
Instruction Fuzzy Hash: 353189B2215214BBEF218F54CD8AFEB3BADEF49721F044155FE089A291C6B59C50CBA0

Function 00985622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00985637
_memcmp.LIBVCRUNTIME ref: 00985659
_memcmp.LIBVCRUNTIME ref: 00985671
_memcmp.LIBVCRUNTIME ref: 00985684
_memcmp.LIBVCRUNTIME ref: 0098569E
_memcmp.LIBVCRUNTIME ref: 009856B1
_memcmp.LIBVCRUNTIME ref: 009856C9
_memcmp.LIBVCRUNTIME ref: 009856E4

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 86504ae7c5080ac5ef6319d1d9bd1b65cfb857847e2132ddf39a865ef7be274d
Instruction ID: 9682bc1c0242b5e651937cc265224d6b4a16cc46e0a14c758d6f4b8e27381073
Opcode Fuzzy Hash: 86504ae7c5080ac5ef6319d1d9bd1b65cfb857847e2132ddf39a865ef7be274d
Instruction Fuzzy Hash: 4821D571B50A097BD6187A20CE92FFB335CAFA03A8F454020FD049A781F725ED5983E9

Function 009A4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 009A5007
NULL Pointer assignment, xrefs: 009A502E, 009A5383

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: a02794c5233f291c2cf53d52bc7197e90281dafae44edba6f427581f4cbac6bb
Instruction ID: 5761484d2e01e858a7cbbad57f3633b4ddaef952a37fb60bbee0201b8ddfaf61
Opcode Fuzzy Hash: a02794c5233f291c2cf53d52bc7197e90281dafae44edba6f427581f4cbac6bb
Instruction Fuzzy Hash: 66D1C571B0061A9FDF10CF98C880BAEB7B9FF89354F158469E915AB281E770DD45CB90

Function 00961522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 009615CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00961651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 009616E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 009616FB

Part of subcall function 00953820: RtlAllocateHeap.NTDLL(00000000,?,009F1444,?,0093FDF5,?,?,0092A976,00000010,009F1440,009213FC,?,009213C6,?,00921129), ref: 00953852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00961777
__freea.LIBCMT ref: 009617A2
__freea.LIBCMT ref: 009617AE

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 1be38e8d9d11e78ec249aae5b6ede7d43045c724b3ed4a91d54c708b1f60d3b6
Instruction ID: 15e80a129b0dee6344b6eda94e89b22a14d1f173026bfcab878abec8cafcfe7d
Opcode Fuzzy Hash: 1be38e8d9d11e78ec249aae5b6ede7d43045c724b3ed4a91d54c708b1f60d3b6
Instruction Fuzzy Hash: 7691C272E002169BDF208E75CD91AEEBBB9AF89310F1C4659F806E7191DB35DD44CBA0

Function 009A4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009A4648
VariantInit.OLEAUT32(?), ref: 009A4749
VariantClear.OLEAUT32(?), ref: 009A4753
VariantClear.OLEAUT32(?), ref: 009A47B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 009A472C
Null Object assignment in FOR..IN loop, xrefs: 009A45D8, 009A4706, 009A47BE

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: ea9008c46634d17131fd50b7cebc9394206ae782f80a5c21df2233e491ab2aed
Instruction ID: f657289c9a21fffe163679d71293c34705949230253c670a4098ca3498333094
Opcode Fuzzy Hash: ea9008c46634d17131fd50b7cebc9394206ae782f80a5c21df2233e491ab2aed
Instruction Fuzzy Hash: 5F918F71A00259ABDF20CFA5DC48FAEBBB8EF86714F108559F515AB281D7B09941CFE0

Function 00991187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0099125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00991284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 009912A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 009912D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0099135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 009913C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00991430

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 7a09862bd71dcd108e9360fa6a5f9450dec4100c9bf5bc1b5b7170f5b62e1a47
Instruction ID: ffe8f26bf9890bba49aa07cbf0da560b400c8808878499b73be23ff948ec72da
Opcode Fuzzy Hash: 7a09862bd71dcd108e9360fa6a5f9450dec4100c9bf5bc1b5b7170f5b62e1a47
Instruction Fuzzy Hash: FC91F575A0021AAFDF00DF9CC885BBE77B9FF85325F104429E950EB2A1D774A941CB90

Function 0093948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 0f632d87f857610c129fe0d2e87fccf533abdebbcc82e4515403d69c89af7d38
Instruction ID: e273ac268c7e00097a1441ec5b715833f1c108382d0ae586ef285dc358292b48
Opcode Fuzzy Hash: 0f632d87f857610c129fe0d2e87fccf533abdebbcc82e4515403d69c89af7d38
Instruction Fuzzy Hash: 12911571D04219EFCB10CFA9C884AEEBBB8FF89320F148555E915B7251D378A981CF60

Function 009A3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009A396B
CharUpperBuffW.USER32(?,?), ref: 009A3A7A
_wcslen.LIBCMT ref: 009A3A8A
VariantClear.OLEAUT32(?), ref: 009A3C1F

Part of subcall function 00990CDF: VariantInit.OLEAUT32(00000000), ref: 00990D1F
Part of subcall function 00990CDF: VariantCopy.OLEAUT32(?,?), ref: 00990D28
Part of subcall function 00990CDF: VariantClear.OLEAUT32(?), ref: 00990D34

Strings

AUTOIT.ERROR, xrefs: 009A3A80, 009A3A85
Incorrect Parameter format, xrefs: 009A39A6, 009A3BA1

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 8e62c765e8935a143967cef05b2238593e73638b3a96627ff242927b08b1862d
Instruction ID: 337963bc6bf0b6ed4c44d2f6073cf3499e68071545b561eb6931cca3be4a471e
Opcode Fuzzy Hash: 8e62c765e8935a143967cef05b2238593e73638b3a96627ff242927b08b1862d
Instruction Fuzzy Hash: 069134756083059FC704EF64C480A6AB7E9BFC9714F14892DF88A9B351DB30EE45CB92

Function 009A4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0098000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0097FF41,80070057,?,?,?,0098035E), ref: 0098002B
Part of subcall function 0098000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0097FF41,80070057,?,?), ref: 00980046
Part of subcall function 0098000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0097FF41,80070057,?,?), ref: 00980054
Part of subcall function 0098000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0097FF41,80070057,?), ref: 00980064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 009A4C51
_wcslen.LIBCMT ref: 009A4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 009A4DCF
CoTaskMemFree.OLE32(?), ref: 009A4DDA

Strings

NULL Pointer assignment, xrefs: 009A4E23, 009A4E52

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: e706c1ed733ac5a4d59dd53cf2d71ba4d4e1f38ff5034a0400e39b617cc36e77
Instruction ID: 339658b411f7200f9a151e0c3e647c2b1270d87c3a6414e9eade1d6edac0583f
Opcode Fuzzy Hash: e706c1ed733ac5a4d59dd53cf2d71ba4d4e1f38ff5034a0400e39b617cc36e77
Instruction Fuzzy Hash: FC913A71D0022D9FDF14DFA4D891AEDB7B8BF89310F104569E919A7241DB749A44CFA0

Function 009B20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 009B2183
GetMenuItemCount.USER32(00000000), ref: 009B21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 009B21DD
_wcslen.LIBCMT ref: 009B2213
GetMenuItemID.USER32(?,?), ref: 009B224D
GetSubMenu.USER32(?,?), ref: 009B225B

Part of subcall function 00983A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00983A57
Part of subcall function 00983A3D: GetCurrentThreadId.KERNEL32 ref: 00983A5E
Part of subcall function 00983A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009825B3), ref: 00983A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 009B22E3

Part of subcall function 0098E97B: Sleep.KERNELBASE ref: 0098E9F3

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: bbac350e1e772237b16a02240d4369b8bd864b29b99df01c485c4a3f8ab3fe0c
Instruction ID: e200f5ac06f57199f7672202549ee44073b0d0b02972844ce50ba6143c2e4a0c
Opcode Fuzzy Hash: bbac350e1e772237b16a02240d4369b8bd864b29b99df01c485c4a3f8ab3fe0c
Instruction Fuzzy Hash: 6E718F75E04215AFCB14DF68C945AEEB7F5EF88320F148459E826EB351D734ED418B90

Function 009B7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(019057B8), ref: 009B7F37
IsWindowEnabled.USER32(019057B8), ref: 009B7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 009B801E
SendMessageW.USER32(019057B8,000000B0,?,?), ref: 009B8051
IsDlgButtonChecked.USER32(?,?), ref: 009B8089
GetWindowLongW.USER32(019057B8,000000EC), ref: 009B80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 009B80C3

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: e7362e735930fd66f0b130afad07976a2e89cb6f482e6ac46ca8d629b06f2bcc
Instruction ID: fd285a5564926eb9a5cfb5ece05edb337bbac492b93880bdd94520d788433506
Opcode Fuzzy Hash: e7362e735930fd66f0b130afad07976a2e89cb6f482e6ac46ca8d629b06f2bcc
Instruction Fuzzy Hash: BD71C074609204EFEB20AF94CE84FFABBBDEF89360F140559F945972A1CB31A845DB14

Function 0098AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0098AEF9
GetKeyboardState.USER32(?), ref: 0098AF0E
SetKeyboardState.USER32(?), ref: 0098AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0098AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0098AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0098AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0098B020

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: b81e0c55b94887367291fce5cb4e522e034a8efa30e9ccc263186492d687b97f
Instruction ID: 9da21dfffee9a33dd8d1d7c8e4c256559bab3b08847703d001c62431411fa75e
Opcode Fuzzy Hash: b81e0c55b94887367291fce5cb4e522e034a8efa30e9ccc263186492d687b97f
Instruction Fuzzy Hash: CB51E0A06083D13DFB3666348C45BBABEA95B06304F0C898AE2E9569C2D3D8E884D751

Function 0098ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0098AD19
GetKeyboardState.USER32(?), ref: 0098AD2E
SetKeyboardState.USER32(?), ref: 0098AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0098ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0098ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0098AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0098AE38

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 2fb3b0c1a6e8beffb0a973545958dfc2101e909a714a035ecfc29b3e5f7c9abc
Instruction ID: 716cc3ed774e3b51809767e26a00b99d3d62b9311f8df27d224ccf01ae6a53df
Opcode Fuzzy Hash: 2fb3b0c1a6e8beffb0a973545958dfc2101e909a714a035ecfc29b3e5f7c9abc
Instruction Fuzzy Hash: 6551F7A15087D53DFB33A3348C55B7ABE9C5B45301F0C898AE1D586AC3D394EC84D752

Function 0095542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00963CD6,?,?,?,?,?,?,?,?,00955BA3,?,?,00963CD6,?,?), ref: 00955470
__fassign.LIBCMT ref: 009554EB
__fassign.LIBCMT ref: 00955506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00963CD6,00000005,00000000,00000000), ref: 0095552C
WriteFile.KERNEL32(?,00963CD6,00000000,00955BA3,00000000,?,?,?,?,?,?,?,?,?,00955BA3,?), ref: 0095554B
WriteFile.KERNEL32(?,?,00000001,00955BA3,00000000,?,?,?,?,?,?,?,?,?,00955BA3,?), ref: 00955584

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: ff69e37ca3dbe50d5a7c97fb940187ea8c85def8cd90174b05d2525e9496ff09
Instruction ID: ae7b1bea09e203ace3b542d94921dd482b514196d5237e687428f296d3ee82de
Opcode Fuzzy Hash: ff69e37ca3dbe50d5a7c97fb940187ea8c85def8cd90174b05d2525e9496ff09
Instruction Fuzzy Hash: A85106B0A006099FCB10CFA9D851AEEBBF9EF48301F15412AF955E7292E730DA45CF60

Function 00942D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00942D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00942D53
_ValidateLocalCookies.LIBCMT ref: 00942DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00942E0C
_ValidateLocalCookies.LIBCMT ref: 00942E61

Strings

csm, xrefs: 00942DF6

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 4086ec078a076dff9ee07dd55f4ad60092aa87875873b40542b51ff92a30fc79
Instruction ID: 403e49b4b07e7b5ed18dc5f8d395529857dac725ad23b295c6a9305ece234ff6
Opcode Fuzzy Hash: 4086ec078a076dff9ee07dd55f4ad60092aa87875873b40542b51ff92a30fc79
Instruction Fuzzy Hash: 09419D34E10209EBCF14DF68C885E9EBBB9BF85328F548155F915AB392D731AA05CB90

Function 009A10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009A304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 009A307A
Part of subcall function 009A304E: _wcslen.LIBCMT ref: 009A309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 009A1112
WSAGetLastError.WSOCK32 ref: 009A1121
WSAGetLastError.WSOCK32 ref: 009A11C9
closesocket.WSOCK32(00000000), ref: 009A11F9

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: b83c510908b764b54cbc583b945b03991332708d069b06d7213539c4b874febb
Instruction ID: 108ac17baf6e78226240de83170bc95bf4d63dd164b2a3d5af0b9df30eac2acd
Opcode Fuzzy Hash: b83c510908b764b54cbc583b945b03991332708d069b06d7213539c4b874febb
Instruction Fuzzy Hash: E7413471204214AFDB109F64C884BAABBE9FF86324F148159FD099F291C774ED41CBE0

Function 0098CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0098DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0098CF22,?), ref: 0098DDFD

Part of subcall function 0098DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0098CF22,?), ref: 0098DE16

lstrcmpiW.KERNEL32(?,?), ref: 0098CF45
MoveFileW.KERNEL32(?,?), ref: 0098CF7F
_wcslen.LIBCMT ref: 0098D005
_wcslen.LIBCMT ref: 0098D01B
SHFileOperationW.SHELL32(?), ref: 0098D061

Strings

\*.*, xrefs: 0098CFF3

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 3c07958e108b721b4aa55418e9e46fc7b2a48e5918221ccaef251a958abbd110
Instruction ID: 00c8fc412fdc77b5d3659c6b57c8439a25632207b9d8755c1af7473028d168d6
Opcode Fuzzy Hash: 3c07958e108b721b4aa55418e9e46fc7b2a48e5918221ccaef251a958abbd110
Instruction Fuzzy Hash: EB4101B19452185FDF12FBA4D981FDEB7BDAF48380F1000A6A645EB241EB34A645CB50

Function 009B2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 009B2E1C
GetWindowLongW.USER32(?,000000F0), ref: 009B2E4F
GetWindowLongW.USER32(?,000000F0), ref: 009B2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 009B2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 009B2EE0
GetWindowLongW.USER32(?,000000F0), ref: 009B2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 009B2F0B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 902e93c148a59b2bd20f11c8aa36cb82ded2da851896000ce74d26cf6d94aad2
Instruction ID: 3410ad9d256c54ff8b2a9f9908d7bcdf2f775a75abc79e76c2baa7b893b841b6
Opcode Fuzzy Hash: 902e93c148a59b2bd20f11c8aa36cb82ded2da851896000ce74d26cf6d94aad2
Instruction Fuzzy Hash: 77310530618155DFDB21CF59DE88FA537E9EB9A720F150164F9018F2B1CBB1E880EB91

Function 00987726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00987769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0098778F
SysAllocString.OLEAUT32(00000000), ref: 00987792
SysAllocString.OLEAUT32(?), ref: 009877B0
SysFreeString.OLEAUT32(?), ref: 009877B9
StringFromGUID2.OLE32(?,?,00000028), ref: 009877DE
SysAllocString.OLEAUT32(?), ref: 009877EC

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 58bd2c2cd87bb3bf72189162c707f7067a3b67161e3a4f3965bfc3b2cd8d580b
Instruction ID: 5b15f61d7cc12572b51c18db033b0272084eb39d5b6160ee4e6155fb4b3eef31
Opcode Fuzzy Hash: 58bd2c2cd87bb3bf72189162c707f7067a3b67161e3a4f3965bfc3b2cd8d580b
Instruction Fuzzy Hash: CF21D376608219AFDF10EFE8CC88DBBB3ACEB09764B148525FA04DB260D670DD41CB60

Function 009877FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00987842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00987868
SysAllocString.OLEAUT32(00000000), ref: 0098786B
SysAllocString.OLEAUT32 ref: 0098788C
SysFreeString.OLEAUT32 ref: 00987895
StringFromGUID2.OLE32(?,?,00000028), ref: 009878AF
SysAllocString.OLEAUT32(?), ref: 009878BD

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 393722644ea4571bef82490b3dd88a5803a1c61e1b178c7d524d9d48dd24e9cd
Instruction ID: 5f22dc9feb89a911032bb9e52935c0030c0fc784c146cbfef186a901346e91b3
Opcode Fuzzy Hash: 393722644ea4571bef82490b3dd88a5803a1c61e1b178c7d524d9d48dd24e9cd
Instruction Fuzzy Hash: 22216271608104AFDB10AFE8DC88DAAB7ACEB497607208125F915DB2A1DA74DD41DB74

Function 009904D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 009904F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0099052E

Strings

nul, xrefs: 00990567

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: d6bdb6339aad5cf3d24199314848065d614d1db2e224ee910948f75009804543
Instruction ID: 67cf83f445664161f26b16e3f5f210e9dc40999234d9f7603bdfbe82f6eb3a0e
Opcode Fuzzy Hash: d6bdb6339aad5cf3d24199314848065d614d1db2e224ee910948f75009804543
Instruction Fuzzy Hash: B8217CB1500305AFDF209F2ED804A9A77A8AF84724F604A29F8B1E62E0E770D940DF21

Function 009905A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 009905C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00990601

Strings

nul, xrefs: 00990639

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 19db0cb8268873a716a6b620e42b0a3740ed1cf2ba3762a989d539cf9c7ea3f1
Instruction ID: f73c7ef199c269c56b081d5182978ccb2bfecd3204f487dc9093a35f03f4447c
Opcode Fuzzy Hash: 19db0cb8268873a716a6b620e42b0a3740ed1cf2ba3762a989d539cf9c7ea3f1
Instruction Fuzzy Hash: 06211975504305AFDF209F6D9844A9A77ACAFD5734F200B29F8B1E72E0E7B09960DB60

Function 009B40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0092600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0092604C
Part of subcall function 0092600E: GetStockObject.GDI32(00000011), ref: 00926060
Part of subcall function 0092600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0092606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 009B4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 009B411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 009B412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 009B4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 009B4145

Strings

Msctls_Progress32, xrefs: 009B40E3

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 94600ad93436de50419c793707e2ab4ff04f51229dbcfb230b25a0fcb767b2a2
Instruction ID: 312fbab7e2e4e187d8ab58980dea7b41b813acbbc0cacdbc703d63deb3f07f88
Opcode Fuzzy Hash: 94600ad93436de50419c793707e2ab4ff04f51229dbcfb230b25a0fcb767b2a2
Instruction Fuzzy Hash: A211B2B2150219BEEF119FA5CC85EE77F5DEF187A8F004111FA18A2050C6729C61EBA4

Function 0095D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0095D7A3: _free.LIBCMT ref: 0095D7CC

_free.LIBCMT ref: 0095D82D

Part of subcall function 009529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0095D7D1,00000000,00000000,00000000,00000000,?,0095D7F8,00000000,00000007,00000000,?,0095DBF5,00000000), ref: 009529DE
Part of subcall function 009529C8: GetLastError.KERNEL32(00000000,?,0095D7D1,00000000,00000000,00000000,00000000,?,0095D7F8,00000000,00000007,00000000,?,0095DBF5,00000000,00000000), ref: 009529F0

_free.LIBCMT ref: 0095D838
_free.LIBCMT ref: 0095D843
_free.LIBCMT ref: 0095D897
_free.LIBCMT ref: 0095D8A2
_free.LIBCMT ref: 0095D8AD
_free.LIBCMT ref: 0095D8B8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: bedb46ce61cf4e422e4300466c6ab8fdacf95abc7c9b22e4750fd3113dd61caf
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 871181B1542B04AAE531FFB2CC07FCB7BDCAF89702F400825BA99A6992DA24B5094750

Function 0098DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0098DA74
LoadStringW.USER32(00000000), ref: 0098DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0098DA91
LoadStringW.USER32(00000000), ref: 0098DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0098DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0098DAB9

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 6ecc176f8b4e4af23c9df91a9ed253e83c1aeb55a92f42c5e34bf6c1581cf35a
Instruction ID: 18275c80d1ee1eb6d4880f42b6f99297a84f2ad32d1ec83a8c0cec458781064e
Opcode Fuzzy Hash: 6ecc176f8b4e4af23c9df91a9ed253e83c1aeb55a92f42c5e34bf6c1581cf35a
Instruction Fuzzy Hash: 7E0186F2904208BFE711ABA49E89EFB376CE708711F400991F746E2081EA749E844F74

Function 0099096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(018FE2F8,018FE2F8), ref: 0099097B
EnterCriticalSection.KERNEL32(018FE2D8,00000000), ref: 0099098D
TerminateThread.KERNEL32(?,000001F6), ref: 0099099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 009909A9
CloseHandle.KERNEL32(?), ref: 009909B8
InterlockedExchange.KERNEL32(018FE2F8,000001F6), ref: 009909C8
LeaveCriticalSection.KERNEL32(018FE2D8), ref: 009909CF

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: a83c7a257c55ddc9221cadb014d1e931c26325069827c02ec2c8e3f5993cbd04
Instruction ID: 2a4a31554ee8120339eb425da03f27b27b084ff431c1dbd6f8175c51b3dc690d
Opcode Fuzzy Hash: a83c7a257c55ddc9221cadb014d1e931c26325069827c02ec2c8e3f5993cbd04
Instruction Fuzzy Hash: F1F08C7205AA02BFDB451FA4EF8CBD6BB38FF01712F402222F212908A0C7709861DF90

Function 00925D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00925D30
GetWindowRect.USER32(?,?), ref: 00925D71
ScreenToClient.USER32(?,?), ref: 00925D99
GetClientRect.USER32(?,?), ref: 00925ED7
GetWindowRect.USER32(?,?), ref: 00925EF8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: c738a10f45b4287d95363b88d530065cf475325d48aca6f3329973d5ae28629e
Instruction ID: 44dc06cf824e9bb4cb9e2457bf062c29c73ec64b9568ff86d9ba948e7b7a360e
Opcode Fuzzy Hash: c738a10f45b4287d95363b88d530065cf475325d48aca6f3329973d5ae28629e
Instruction Fuzzy Hash: A3B19974A00B4AEBDB10CFA8C4807EEB7F5FF48310F15891AE8A9D7254DB34AA50DB50

Function 009501B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 009500BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009500D6
__allrem.LIBCMT ref: 009500ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0095010B
__allrem.LIBCMT ref: 00950122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00950140

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 7d3276a3c146ba6e4cc8be01fb4a8fcd1c7db721d7f5b52b0af6398797f111de
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: CB81F372A00B069BE720DF3ACC51B6A73E8EFC1325F24463AF851D66C1E770D9088B91

Function 009A1D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009A3149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,009A101C,00000000,?,?,00000000), ref: 009A3195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 009A1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 009A1DE1
WSAGetLastError.WSOCK32 ref: 009A1DF2
inet_ntoa.WSOCK32(?), ref: 009A1E8C
htons.WSOCK32(?,?,?,?,?), ref: 009A1EDB
_strlen.LIBCMT ref: 009A1F35

Part of subcall function 009839E8: _strlen.LIBCMT ref: 009839F2

Part of subcall function 00926D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,0093CF58,?,?,?), ref: 00926DBA
Part of subcall function 00926D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,0093CF58,?,?,?), ref: 00926DED

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 720b7739cf13fb9df7a731082a840b5b71719b703d84164d6bee710a2b3281d3
Instruction ID: 832e4b8f91247586d7a0c773364d265b083bdffaf3179c006a3019f0ba828a84
Opcode Fuzzy Hash: 720b7739cf13fb9df7a731082a840b5b71719b703d84164d6bee710a2b3281d3
Instruction Fuzzy Hash: 58A1BC71604350AFC324DF20C895F2A7BA9EFC6318F54894CF4569B2A2DB31ED46CB91

Function 009561FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,009482D9,009482D9,?,?,?,0095644F,00000001,00000001,8BE85006), ref: 00956258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0095644F,00000001,00000001,8BE85006,?,?,?), ref: 009562DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 009563D8
__freea.LIBCMT ref: 009563E5

Part of subcall function 00953820: RtlAllocateHeap.NTDLL(00000000,?,009F1444,?,0093FDF5,?,?,0092A976,00000010,009F1440,009213FC,?,009213C6,?,00921129), ref: 00953852

__freea.LIBCMT ref: 009563EE
__freea.LIBCMT ref: 00956413

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: fd5cb1aa28c0b3a51b2992af9c54a2ac2a5014ffa9890062b5e00d2d10e6d209
Instruction ID: 85ec045b3d2380c7e7dc5ccb55992b2d5457ec61ab15550bda8c230f7ef0c332
Opcode Fuzzy Hash: fd5cb1aa28c0b3a51b2992af9c54a2ac2a5014ffa9890062b5e00d2d10e6d209
Instruction Fuzzy Hash: 4751DF72A00216ABEB25CF66DC81FAF77A9EB84752F544629FC05E7150EB34DC48C7A0

Function 009ABBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

Part of subcall function 009AC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,009AB6AE,?,?), ref: 009AC9B5
Part of subcall function 009AC998: _wcslen.LIBCMT ref: 009AC9F1
Part of subcall function 009AC998: _wcslen.LIBCMT ref: 009ACA68
Part of subcall function 009AC998: _wcslen.LIBCMT ref: 009ACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009ABCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 009ABD25
RegCloseKey.ADVAPI32(00000000), ref: 009ABD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 009ABD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 009ABDF3
RegCloseKey.ADVAPI32(?), ref: 009ABDFF

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: a18d6990ecd9cd030d1304bd69e4f5343a195b509dd1922ba330fe25295ac21f
Instruction ID: ed1fc2f75be50bee7cc082d8bcb561c387fd3820e44897b03fa5ac4b74b0b60d
Opcode Fuzzy Hash: a18d6990ecd9cd030d1304bd69e4f5343a195b509dd1922ba330fe25295ac21f
Instruction Fuzzy Hash: 76818E71208241EFD714DF24C895E2ABBE9FF85318F14895CF4998B2A2DB31ED45CB92

Function 0097F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0097F7B9
SysAllocString.OLEAUT32(00000001), ref: 0097F860
VariantCopy.OLEAUT32(0097FA64,00000000), ref: 0097F889
VariantClear.OLEAUT32(0097FA64), ref: 0097F8AD
VariantCopy.OLEAUT32(0097FA64,00000000), ref: 0097F8B1
VariantClear.OLEAUT32(?), ref: 0097F8BB

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 37882c02fdb1f1d051e4c546f3302b55bc053de71ec6d897d5b69ed39b5d7ee4
Instruction ID: 0ee852780f2a5f4609c9b1d4e70f9c47aeb024b6dbf77cb39d6e8c4026a0a134
Opcode Fuzzy Hash: 37882c02fdb1f1d051e4c546f3302b55bc053de71ec6d897d5b69ed39b5d7ee4
Instruction Fuzzy Hash: B3510A36510310BACF14AB65D8B5B69B3A9EF85310F24C467F90AFF295D7748C40CB66

Function 0099910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00927620: _wcslen.LIBCMT ref: 00927625

Part of subcall function 00926B57: _wcslen.LIBCMT ref: 00926B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 009994E5
_wcslen.LIBCMT ref: 00999506
_wcslen.LIBCMT ref: 0099952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00999585

Strings

X, xrefs: 00999412

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: b14ab6ff53df42e0e57a445163b1ddc0ca88b7758e24b2756dae4f54ad7952f0
Instruction ID: 18caacd0daed703806780c9b6d60d5c807321956127d650d3b3777f5dfec04ce
Opcode Fuzzy Hash: b14ab6ff53df42e0e57a445163b1ddc0ca88b7758e24b2756dae4f54ad7952f0
Instruction Fuzzy Hash: F8E19E315083519FDB24DF28D881B6AB7E4BFC4314F04896DF8999B2A6DB31DD05CB92

Function 0093920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00939BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00939BB2

BeginPaint.USER32(?,?,?), ref: 00939241
GetWindowRect.USER32(?,?), ref: 009392A5
ScreenToClient.USER32(?,?), ref: 009392C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 009392D3
EndPaint.USER32(?,?,?,?,?), ref: 00939321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 009771EA

Part of subcall function 00939339: BeginPath.GDI32(00000000), ref: 00939357

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: bc89967c3c06fc1fd8729ce5891358e1bc4d46a85d900501edc05567137bdbd3
Instruction ID: 33e39ba7d1e1b33d992263b6832ef2966ef4622e5112314bc3ccc660b4177cbf
Opcode Fuzzy Hash: bc89967c3c06fc1fd8729ce5891358e1bc4d46a85d900501edc05567137bdbd3
Instruction Fuzzy Hash: 4741DE71108301EFD710DF64DC84FBA7BB8EB85324F000669F9A4872A1C7B19845EFA1

Function 009907EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0099080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00990847
EnterCriticalSection.KERNEL32(?), ref: 00990863
LeaveCriticalSection.KERNEL32(?), ref: 009908DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 009908F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00990921

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 8f98f8eb7a48db0972bb0ff464e8aca44457342df98af3caccfdacd5d6d77eca
Instruction ID: 0e014368253a0439fe008ff0f7d3200661b4c9d109dd40442456aa8e800dcf25
Opcode Fuzzy Hash: 8f98f8eb7a48db0972bb0ff464e8aca44457342df98af3caccfdacd5d6d77eca
Instruction Fuzzy Hash: 3B417A71A00205EFDF14AF58DC85AAA77B8FF84310F1440A9ED14AE297DB31DE60DBA0

Function 009B81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0097F3AB,00000000,?,?,00000000,?,0097682C,00000004,00000000,00000000), ref: 009B824C
EnableWindow.USER32(?,00000000), ref: 009B8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 009B82D1
ShowWindow.USER32(?,00000004), ref: 009B82E5
EnableWindow.USER32(?,00000001), ref: 009B830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 009B832F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: f08d535a41796d40913ed0b9e7a56dbff0528ec5dfc10eef0b5a6086d9a5ee1d
Instruction ID: 75bfd6921a92f304bbcfa283446328f0ed51301d5d68d542e6ac44bd13cf8133
Opcode Fuzzy Hash: f08d535a41796d40913ed0b9e7a56dbff0528ec5dfc10eef0b5a6086d9a5ee1d
Instruction Fuzzy Hash: DF41D534605640EFDB15CF14DA99FE57BE8FB0E764F1802A8E5184F262CB71AC41DB90

Function 00984C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00984C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00984CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00984CEA
_wcslen.LIBCMT ref: 00984D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00984D10
_wcsstr.LIBVCRUNTIME ref: 00984D1A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: c8d20138f86258f53be44b17495df6a7065e3a49cfcdfef02896717fbe44d62c
Instruction ID: a9c9bd9713fe86acab0f4a65dc7a35e5933116cfc7a4e4a105f3e9c8e99fa739
Opcode Fuzzy Hash: c8d20138f86258f53be44b17495df6a7065e3a49cfcdfef02896717fbe44d62c
Instruction Fuzzy Hash: 22210B72604202BBEB256B35DD49F7B7B9CDF45760F104039F805CA291EA65DC0197A0

Function 0099581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00923AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00923A97,?,?,00922E7F,?,?,?,00000000), ref: 00923AC2

_wcslen.LIBCMT ref: 0099587B
CoInitialize.OLE32(00000000), ref: 00995995
CoCreateInstance.OLE32(009BFCF8,00000000,00000001,009BFB68,?), ref: 009959AE
CoUninitialize.OLE32 ref: 009959CC

Strings

.lnk, xrefs: 00995876, 009958C1, 00995985

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 699b326055086b3bd174e07ea998ebac0007f7b7fdc33311b7ee714f1c5db2ed
Instruction ID: bccca4487243b5ec6257e633b12c901301b051968b4b7530b96183c7259a34cc
Opcode Fuzzy Hash: 699b326055086b3bd174e07ea998ebac0007f7b7fdc33311b7ee714f1c5db2ed
Instruction Fuzzy Hash: 47D162716087119FCB15DF28C480A2BBBE5EF89724F15885DF88A9B361DB31EC45CB92

Function 0098175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00980FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00980FCA
Part of subcall function 00980FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00980FD6
Part of subcall function 00980FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00980FE5
Part of subcall function 00980FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00980FEC
Part of subcall function 00980FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00981002

GetLengthSid.ADVAPI32(?,00000000,00981335), ref: 009817AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 009817BA
HeapAlloc.KERNEL32(00000000), ref: 009817C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 009817DA
GetProcessHeap.KERNEL32(00000000,00000000,00981335), ref: 009817EE
HeapFree.KERNEL32(00000000), ref: 009817F5

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: e514d4a1d58bc0b52bbaf701cf8276432f2ef5b6551429fd2b0181dc383c40cd
Instruction ID: 1adfa79ff91b1fca666c158ea25d62041a9e24420fa30a8bf73310ced3872ced
Opcode Fuzzy Hash: e514d4a1d58bc0b52bbaf701cf8276432f2ef5b6551429fd2b0181dc383c40cd
Instruction Fuzzy Hash: F511A9B2618205FFDB10AFA8DD49BAE7BADEB41365F10411DF481A7210C736A945DB60

Function 009814CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 009814FF
OpenProcessToken.ADVAPI32(00000000), ref: 00981506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00981515
CloseHandle.KERNEL32(00000004), ref: 00981520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0098154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00981563

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: a852c0f7a85b159e4bca1c608f8645c84b601093ab876ca7e4315324237b9acd
Instruction ID: 8dd56d65262afa2403337c91c1c62c52eaae293f3cd589a9fdccd629a3b65f6c
Opcode Fuzzy Hash: a852c0f7a85b159e4bca1c608f8645c84b601093ab876ca7e4315324237b9acd
Instruction Fuzzy Hash: 1D116AB260420DABDF119FA8DE49FDE7BADEF48714F044124FA05A2160C375CE61EB60

Function 00943382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00943379,00942FE5), ref: 00943390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0094339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009433B7
SetLastError.KERNEL32(00000000,?,00943379,00942FE5), ref: 00943409

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: fb0360d8637b54d84dc57a7a4394effa30dc2a29844c7b00ec41b0be1a8b2a33
Instruction ID: 555fbc42ffd02a3c62bc2c6785bd8d0331388b86c723efd4c6e8b7c76af6019c
Opcode Fuzzy Hash: fb0360d8637b54d84dc57a7a4394effa30dc2a29844c7b00ec41b0be1a8b2a33
Instruction Fuzzy Hash: CF01F77361D722BFAA292B747CC6F672A98EB4977A7608329F420852F1EF114E026544

Function 00952D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00955686,00963CD6,?,00000000,?,00955B6A,?,?,?,?,?,0094E6D1,?,009E8A48), ref: 00952D78
_free.LIBCMT ref: 00952DAB
_free.LIBCMT ref: 00952DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0094E6D1,?,009E8A48,00000010,00924F4A,?,?,00000000,00963CD6), ref: 00952DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0094E6D1,?,009E8A48,00000010,00924F4A,?,?,00000000,00963CD6), ref: 00952DEC
_abort.LIBCMT ref: 00952DF2

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: e008c0c1e1758b7afeec1e060380b949d124ab202367b2c83b9cbe293a53c6a3
Instruction ID: 9a5678081f9bce36c58994696ccc66a8bc63f9f92c48200524a4c51149dd2655
Opcode Fuzzy Hash: e008c0c1e1758b7afeec1e060380b949d124ab202367b2c83b9cbe293a53c6a3
Instruction Fuzzy Hash: F6F0A472508A0027C212E737BD06F6A276DABC37B7F254519FC64A61D2EF24880E5360

Function 009B8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00939639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00939693
Part of subcall function 00939639: SelectObject.GDI32(?,00000000), ref: 009396A2
Part of subcall function 00939639: BeginPath.GDI32(?), ref: 009396B9
Part of subcall function 00939639: SelectObject.GDI32(?,00000000), ref: 009396E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 009B8A4E
LineTo.GDI32(?,00000003,00000000), ref: 009B8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 009B8A70
LineTo.GDI32(?,00000000,00000003), ref: 009B8A80
EndPath.GDI32(?), ref: 009B8A90
StrokePath.GDI32(?), ref: 009B8AA0

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 2fecd3b549e2392cce2250d582feae02635f3c3437661602082cc208af43d51b
Instruction ID: 2f8b758722053bac31a072adb4d82ad4b367ed6a467b21236e5b97f72832c720
Opcode Fuzzy Hash: 2fecd3b549e2392cce2250d582feae02635f3c3437661602082cc208af43d51b
Instruction Fuzzy Hash: DB11F77640410DFFDF129F94DD88EAA7F6CEB083A4F008112FA199A1A1C7719D55EFA0

Function 009851FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00985218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00985229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00985230
ReleaseDC.USER32(00000000,00000000), ref: 00985238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0098524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00985261

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: f66465d7594d52fc7b2285de81658636d71d02694a3b2c748eb3d729d18bd097
Instruction ID: 72f27053e45b167257858e02cdece49248edee30d39dec71d43fc1f57cf9d74d
Opcode Fuzzy Hash: f66465d7594d52fc7b2285de81658636d71d02694a3b2c748eb3d729d18bd097
Instruction Fuzzy Hash: A00184B5E04709BBEB106BA99D49E4EBFB8EB48761F044165FA04A7280DA709800DB60

Function 00921BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00921BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00921BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00921C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00921C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00921C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00921C22

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: ad59d4ac5f23797c3341cfe9e9ad8ebb9dc4aad83d63b7ff942a3b4406edb35d
Instruction ID: e38098a8c63076e717ae6d15af2a8b566e26c677e1906ecab580f4ef016ba1cc
Opcode Fuzzy Hash: ad59d4ac5f23797c3341cfe9e9ad8ebb9dc4aad83d63b7ff942a3b4406edb35d
Instruction Fuzzy Hash: 010167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CBE5

Function 0098EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0098EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0098EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0098EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0098EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0098EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0098EB75

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: be37d570bd351c41e1f79ddc13bb4a8e36521cfb91e558622c802852267e347d
Instruction ID: 0c3e206ce7b8286aeeb07ab7375833ce27cf85e297246b66fc82c1105d9c2f69
Opcode Fuzzy Hash: be37d570bd351c41e1f79ddc13bb4a8e36521cfb91e558622c802852267e347d
Instruction Fuzzy Hash: 5CF054B2154159BBE7215B529D0DEEF3F7CEFCAB21F000259F601E1191E7A05A01D7B5

Function 00977439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00977452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00977469
GetWindowDC.USER32(?), ref: 00977475
GetPixel.GDI32(00000000,?,?), ref: 00977484
ReleaseDC.USER32(?,00000000), ref: 00977496
GetSysColor.USER32(00000005), ref: 009774B0

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: c567ccdc4a359f3c0750f70df97ed863f3bda01928c37f9ff56a2a4d0ba9ce6f
Instruction ID: ee4bdbc5b803e8232a9b766a3ccc54b0d4e545b1c699ff5395bb25796cd5ac5b
Opcode Fuzzy Hash: c567ccdc4a359f3c0750f70df97ed863f3bda01928c37f9ff56a2a4d0ba9ce6f
Instruction Fuzzy Hash: B6018B72418205FFDB105FA4DD08FAABBB6FB04321F514264F91AA20B0CB711E41EF50

Function 00981874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0098187F
UnloadUserProfile.USERENV(?,?), ref: 0098188B
CloseHandle.KERNEL32(?), ref: 00981894
CloseHandle.KERNEL32(?), ref: 0098189C
GetProcessHeap.KERNEL32(00000000,?), ref: 009818A5
HeapFree.KERNEL32(00000000), ref: 009818AC

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: d3d5345d652e96a955f2f9840b3165d0d759f4f8db3fd842b331dfd1f20f25e2
Instruction ID: 8533af90da4a5ce2563e59929a4c6faa7a6e94ff01e012fcfd2f3485e41d141c
Opcode Fuzzy Hash: d3d5345d652e96a955f2f9840b3165d0d759f4f8db3fd842b331dfd1f20f25e2
Instruction Fuzzy Hash: C8E0E5B601C101BBDB015FA5EE0C90ABF79FF49B32B508321F22591070CB329420EF60

Function 0098C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00927620: _wcslen.LIBCMT ref: 00927625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0098C6EE
_wcslen.LIBCMT ref: 0098C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0098C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0098C7CA

Strings

0, xrefs: 0098C6AF

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 35d8c432562e84370cc8367057c67653f4f687e75f239f2e0d51d2a48efb3a3b
Instruction ID: 17f2724f494a80a443cd54af68110208c5e1140765ebc58d1e34e49a04b70c5c
Opcode Fuzzy Hash: 35d8c432562e84370cc8367057c67653f4f687e75f239f2e0d51d2a48efb3a3b
Instruction Fuzzy Hash: D551B3B16183019BD724AF28D885B6B77E8AF89314F040A2DF995D3390DB74D944DFA2

Function 009AAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 009AAEA3

Part of subcall function 00927620: _wcslen.LIBCMT ref: 00927625

GetProcessId.KERNEL32(00000000), ref: 009AAF38
CloseHandle.KERNEL32(00000000), ref: 009AAF67

Strings

@, xrefs: 009AAE72
<, xrefs: 009AAE6B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 1fca862d0bd72976a4bd6d7d724174b5d7f2489df1ac53f9026efc465e483f4c
Instruction ID: 47a1c9e223a8f4b99ca440acb8d6656f1fd963a2cba0606d981dadd63e594aa4
Opcode Fuzzy Hash: 1fca862d0bd72976a4bd6d7d724174b5d7f2489df1ac53f9026efc465e483f4c
Instruction Fuzzy Hash: 1C716771A00229DFCB14DFA4D484A9EBBF4FF49310F148499E856AB3A2CB74ED45CB91

Function 0098719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00987206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0098723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0098724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 009872CF

Strings

DllGetClassObject, xrefs: 00987242

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 46da5f71776961aa43409c735a36bad84894b9f0f30c1c4542516a8ed9a49013
Instruction ID: 5a0883ec4f1db645c23e5e3389c930ed848dc13275947a36c3b59e51546f8885
Opcode Fuzzy Hash: 46da5f71776961aa43409c735a36bad84894b9f0f30c1c4542516a8ed9a49013
Instruction Fuzzy Hash: 484171B1604208DFDB15DF94C884A9ABBA9EF84310F2480A9BD199F31AD7B4DD44DBA0

Function 009B3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 009B3E35
IsMenu.USER32(?), ref: 009B3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 009B3E92
DrawMenuBar.USER32 ref: 009B3EA5

Strings

0, xrefs: 009B3D89

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: c3fc0e92db3e813dae74ab64fe3c090f5324f7babf6a0ac2a9851552221b787d
Instruction ID: cf08a4db86a3444e3af9f44c1c7a978911d9c65e645d085d93ccec1077fc29da
Opcode Fuzzy Hash: c3fc0e92db3e813dae74ab64fe3c090f5324f7babf6a0ac2a9851552221b787d
Instruction Fuzzy Hash: 40414B75A14209EFDB10DF50D984AEAB7B9FF44360F04812AF9059B250D770EE44DFA0

Function 00981DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

Part of subcall function 00983CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00983CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00981E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00981E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00981EA9

Part of subcall function 00926B57: _wcslen.LIBCMT ref: 00926B6A

Strings

ListBox, xrefs: 00981E25
ComboBox, xrefs: 00981DF0

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: d6a4c8b87a730357279a7b1363e9a07d2420a9b22f61e2153ffd898d3e8ba181
Instruction ID: 7b811cfb9e214600db4d4f53417e6b0d20d7ea1f83609f97f0cf3427748aa5db
Opcode Fuzzy Hash: d6a4c8b87a730357279a7b1363e9a07d2420a9b22f61e2153ffd898d3e8ba181
Instruction Fuzzy Hash: 042105B1A00104BBDB14BB64EC55DFFB7BCEF85364F144529F825A72E2DB78490A9720

Function 009AC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009AC9F1
_wcslen.LIBCMT ref: 009ACA68
_wcslen.LIBCMT ref: 009ACA9E
_wcslen.LIBCMT ref: 009ACAF9
_wcslen.LIBCMT ref: 009ACB2F
_wcslen.LIBCMT ref: 009ACB7F

Strings

HKLM, xrefs: 009ACA98, 009ACA9D
HKEY_LOCAL_MACHINE, xrefs: 009ACA62, 009ACA67

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: fd65a3a2b14b013b8b1a4d821dfa1c34124294dd18ff9ead2823f178db0a69cf
Instruction ID: cc086065d7457535b28fd73d9feec15185a1c9c1418971c65fc57daa5d5ea1a6
Opcode Fuzzy Hash: fd65a3a2b14b013b8b1a4d821dfa1c34124294dd18ff9ead2823f178db0a69cf
Instruction Fuzzy Hash: 903128B3A0056D8BCB21EF6D99406BE33999BA3794F054029E845AF344EA70CD40D3E1

Function 009B2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 009B2F8D
LoadLibraryW.KERNEL32(?), ref: 009B2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 009B2FA9
DestroyWindow.USER32(?), ref: 009B2FB1

Strings

SysAnimate32, xrefs: 009B2F68

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 8155a1ac6fc1677095ca0169357a8442cf7c857f25d67b982091549d6c95cc79
Instruction ID: bb8c0ded2efb0f394b24e59ee024efb57e8073f47770ac6168ecec2b2563c333
Opcode Fuzzy Hash: 8155a1ac6fc1677095ca0169357a8442cf7c857f25d67b982091549d6c95cc79
Instruction Fuzzy Hash: DB218871214205ABEB104FA49D84EBB77BDEB99374F100618F950921A0D671DC91A760

Function 00944D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00944D1E,009528E9,?,00944CBE,009528E9,009E88B8,0000000C,00944E15,009528E9,00000002), ref: 00944D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00944DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00944D1E,009528E9,?,00944CBE,009528E9,009E88B8,0000000C,00944E15,009528E9,00000002,00000000), ref: 00944DC3

Strings

CorExitProcess, xrefs: 00944D98
mscoree.dll, xrefs: 00944D86

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b40d740b3de7d67ab071d111969c6d0090f60d164935d590961c74f70ab76474
Instruction ID: 653e233caeab38e00ff772f162d8d708a2547e0769e262be4414daff24724003
Opcode Fuzzy Hash: b40d740b3de7d67ab071d111969c6d0090f60d164935d590961c74f70ab76474
Instruction Fuzzy Hash: 07F0AF70A54208BBDB109F94DC49FADBBB8EF84722F0001A8F909A62A0CB706D40DA91

Function 00924E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00924EDD,?,009F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00924E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00924EAE
FreeLibrary.KERNEL32(00000000,?,?,00924EDD,?,009F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00924EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 00924EA8
kernel32.dll, xrefs: 00924E94

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 9067adea52ae22e8c12558912177d44999b9106fd3d8f947e54aa16694c96cf5
Instruction ID: 455da8404a2891fda4c573007aa88e98b2d0f16068a3e1b28875fed76fd612e1
Opcode Fuzzy Hash: 9067adea52ae22e8c12558912177d44999b9106fd3d8f947e54aa16694c96cf5
Instruction Fuzzy Hash: 76E08CB6A1A6325BA3321B29BC1CA6F665CAFC1F72B060215FC04E2204DBA0CD0290A0

Function 00924E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00963CDE,?,009F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00924E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00924E74
FreeLibrary.KERNEL32(00000000,?,?,00963CDE,?,009F1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00924E87

Strings

kernel32.dll, xrefs: 00924E5B
Wow64RevertWow64FsRedirection, xrefs: 00924E6E

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: ee772546a3404184960e79ef370d13a94e0a31c2be54503a43869bec958a2a4d
Instruction ID: 7eb292cd4ef5de0e4042da13ac5ff15e25dd9d3215f644c17778e591fb89229a
Opcode Fuzzy Hash: ee772546a3404184960e79ef370d13a94e0a31c2be54503a43869bec958a2a4d
Instruction Fuzzy Hash: 61D0C23151A632576A221B29BC0CD8F2A1CAF81B353060610F804B2128CF60CD02D1E1

Function 00992947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00992C05
DeleteFileW.KERNEL32(?), ref: 00992C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00992C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00992CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00992CC0

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 24fcccfcc74ce721449e397c58b61196516c042ad0b48227b0377169872fbe62
Instruction ID: 02f230a94d3a4572b37e007f83811c29a017616f93b1b73f2e46aac607f0f3e8
Opcode Fuzzy Hash: 24fcccfcc74ce721449e397c58b61196516c042ad0b48227b0377169872fbe62
Instruction Fuzzy Hash: DCB13C72D01129ABDF25DBA8CC85FDEBBBDEF89350F1040A6F509E6145EA309E448F61

Function 009AA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 009AA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 009AA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 009AA468
CloseHandle.KERNEL32(?), ref: 009AA63D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: c495979c4f49d1ef88936fe207383975ec02847101d829e7b4284ebc35e0e7a3
Instruction ID: 2efdc061017d67e8aeb370d5df87688d4cca94f0ef268f8147de34f4ba5aaa2c
Opcode Fuzzy Hash: c495979c4f49d1ef88936fe207383975ec02847101d829e7b4284ebc35e0e7a3
Instruction Fuzzy Hash: CCA1A0B16043009FD720DF24D886F2AB7E5AF88714F14881DF59A9B2D2D7B0ED41CB92

Function 0098E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0098DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0098CF22,?), ref: 0098DDFD

Part of subcall function 0098DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0098CF22,?), ref: 0098DE16

Part of subcall function 0098E199: GetFileAttributesW.KERNEL32(?,0098CF95), ref: 0098E19A

lstrcmpiW.KERNEL32(?,?), ref: 0098E473
MoveFileW.KERNEL32(?,?), ref: 0098E4AC
_wcslen.LIBCMT ref: 0098E5EB
_wcslen.LIBCMT ref: 0098E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0098E650

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: d31dda08f4f682b8c59e93726d5908f08af899854442b0f669f997ab1bf82db5
Instruction ID: f04116ab7ab9e4f9d067d44bbb6d936d57b3045b681f89d7edacc9b336d48e26
Opcode Fuzzy Hash: d31dda08f4f682b8c59e93726d5908f08af899854442b0f669f997ab1bf82db5
Instruction Fuzzy Hash: 475130B24083455BC724EBA0D891ADFB3ECAFC4350F00492EF589D3291EF74A6888766

Function 009AB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

Part of subcall function 009AC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,009AB6AE,?,?), ref: 009AC9B5
Part of subcall function 009AC998: _wcslen.LIBCMT ref: 009AC9F1
Part of subcall function 009AC998: _wcslen.LIBCMT ref: 009ACA68
Part of subcall function 009AC998: _wcslen.LIBCMT ref: 009ACA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009ABAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 009ABB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 009ABB63
RegCloseKey.ADVAPI32(?,?), ref: 009ABBA6
RegCloseKey.ADVAPI32(00000000), ref: 009ABBB3

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 09fc30003c97083ecdbd65195f83b7229bcc098160ae4db96c6d51275943ddd8
Instruction ID: 98af06b319f1bfa59150abe548521a7b57eca09108ee9bd2cafdc87cf740747a
Opcode Fuzzy Hash: 09fc30003c97083ecdbd65195f83b7229bcc098160ae4db96c6d51275943ddd8
Instruction Fuzzy Hash: 66619171208241AFD714DF54C490F2ABBE9FF85308F54896CF4998B2A2DB31ED45CB92

Function 00988BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00988BCD
VariantClear.OLEAUT32 ref: 00988C3E
VariantClear.OLEAUT32 ref: 00988C9D
VariantClear.OLEAUT32(?), ref: 00988D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00988D3B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 97b016b87b4a22f89fcf4d3b454e1d140183cc9af9309bb6b0cc4baf8149e0c4
Instruction ID: bbbd72c9cfdf1bfcbd3e53cd4e0ba9eb337a52676adcfaa5b1190731cabca727
Opcode Fuzzy Hash: 97b016b87b4a22f89fcf4d3b454e1d140183cc9af9309bb6b0cc4baf8149e0c4
Instruction Fuzzy Hash: FD5179B5A10219EFCB10DF68C894AAAB7F9FF89310B158559F909DB354E730E911CFA0

Function 00998AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00998BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00998BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00998C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00998C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00998C5F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 7935e195ec7a54cffe977bc69d58177820610a45fe1c40e959287129a9487e68
Instruction ID: 04b7a4c3419c2374a753a42a4e676f2a9a5f3dec9a725a204f89e728361a2d8a
Opcode Fuzzy Hash: 7935e195ec7a54cffe977bc69d58177820610a45fe1c40e959287129a9487e68
Instruction Fuzzy Hash: 17514875A002159FCB00DF64C884E6ABBF5FF89314F088458E849AB362DB35ED41CBA0

Function 009A8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 009A8F40
GetProcAddress.KERNEL32(00000000,?), ref: 009A8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 009A8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 009A9032
FreeLibrary.KERNEL32(00000000), ref: 009A9052

Part of subcall function 0093F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00991043,?,753CE610), ref: 0093F6E6
Part of subcall function 0093F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0097FA64,00000000,00000000,?,?,00991043,?,753CE610,?,0097FA64), ref: 0093F70D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 172954dc458000a9da85bee159c07448aec5b402a666daf9d655c77f6111b564
Instruction ID: 087c71dfa5ecd00d15e21cc489a1d2d450721a75351ead798698393df64bb290
Opcode Fuzzy Hash: 172954dc458000a9da85bee159c07448aec5b402a666daf9d655c77f6111b564
Instruction Fuzzy Hash: CF512834604215DFC711DF58C4949A9BBF5FF4A324B0880A8E806AB362DB31ED86CBD0

Function 009B6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 009B6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 009B6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 009B6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0099AB79,00000000,00000000), ref: 009B6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 009B6CC7

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 056d6fc1493f34bf6f2e81e9ad77b694685e71123c89047039816dcefca65dfa
Instruction ID: 92cda7cd7f1bed6776f1959a895dad45ab987e623927bd45b5241dd0cadfff31
Opcode Fuzzy Hash: 056d6fc1493f34bf6f2e81e9ad77b694685e71123c89047039816dcefca65dfa
Instruction Fuzzy Hash: D341C235A08114AFD724CF68CE58FE57FA8EB09370F140228FAD5A72A0C379BD40DA90

Function 00952051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009520C3
_free.LIBCMT ref: 009520E3

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5b9a2ef70f43702738c28d3160f73fa4e8d219d6611d1d286b06a05730745a8b
Instruction ID: c5eb07099a1205b0cea1b7812d88728875c75b71768d4c3d75af8235a8cfdba9
Opcode Fuzzy Hash: 5b9a2ef70f43702738c28d3160f73fa4e8d219d6611d1d286b06a05730745a8b
Instruction Fuzzy Hash: 6F41E372E002009FCB24DF79C981A5EB7F5EF8A315F1545A8EA15EB391DB31AD05CB80

Function 0093912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00939141
ScreenToClient.USER32(00000000,?), ref: 0093915E
GetAsyncKeyState.USER32(00000001), ref: 00939183
GetAsyncKeyState.USER32(00000002), ref: 0093919D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: de0799b4e72efa7b493ed6e3836177212381d80e0be81a6f3e2ed8b6024db2ad
Instruction ID: ce60922f0198868eee1b860dd6107445271927d1c32e1653724c1c2cb8af14ca
Opcode Fuzzy Hash: de0799b4e72efa7b493ed6e3836177212381d80e0be81a6f3e2ed8b6024db2ad
Instruction Fuzzy Hash: 28416C71A0C60AFBDF159FA4C848BEEF778FB45320F208629E429A3290C7746950DF91

Function 00993874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 009938CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00993922
TranslateMessage.USER32(?), ref: 0099394B
DispatchMessageW.USER32(?), ref: 00993955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00993966

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: f447f2431bd9aeffd9b6ca2aec7ec79f34210e28b972cea572ccd0082d6426a0
Instruction ID: 6a9282ed3ba07aad3cc06ff1519d52694f80e84182e337b26eff9ebcfa2b567f
Opcode Fuzzy Hash: f447f2431bd9aeffd9b6ca2aec7ec79f34210e28b972cea572ccd0082d6426a0
Instruction Fuzzy Hash: AF31E070918342DFEF39CF399948BB637ECAB11304F04856DE466C21A0E3F5AA84DB61

Function 0099CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 0099CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0099CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0099C21E,00000000), ref: 0099CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0099C21E,00000000), ref: 0099CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0099C21E,00000000), ref: 0099CFF2

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: c423997fbe9ac6794a4cf61d51e920dd7ebd1c7cab10a31327e1296715331c54
Instruction ID: c08f72d187b87d1b9f761dd9ec510666d658b761a10bdfb01c44beac33bedaa0
Opcode Fuzzy Hash: c423997fbe9ac6794a4cf61d51e920dd7ebd1c7cab10a31327e1296715331c54
Instruction Fuzzy Hash: B8314AB1A04205AFDF20DFA9CD84AABBBFDEB54351B10442EF516D2241EB30EE409B60

Function 00981901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00981915
PostMessageW.USER32(00000001,00000201,00000001), ref: 009819C1
Sleep.KERNEL32(00000000,?,?,?), ref: 009819C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 009819DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 009819E2

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 484a82f738b0c2c2d034c344ba835ab37f3f54eabde1a9fcbf91f6f77afdce5b
Instruction ID: 56d0c9dbf241e6daacec3717dd0798faa2c1b14d2e36dace3869f383bd60c06f
Opcode Fuzzy Hash: 484a82f738b0c2c2d034c344ba835ab37f3f54eabde1a9fcbf91f6f77afdce5b
Instruction Fuzzy Hash: EC31C271900219EFCB00DFACDD99AEE3BB9EB44325F104329F961A72D1C7709945DB90

Function 009B5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 009B5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 009B579D
_wcslen.LIBCMT ref: 009B57AF
_wcslen.LIBCMT ref: 009B57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 009B5816

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 02e1d77c3ccb30903b52678b667e9c3459a289433f573f3f4bd9c8dd8e71072e
Instruction ID: 6cb2d4d878d242265cee42ba7e8970620a9188fc7b040ce9fbf20366c57bba70
Opcode Fuzzy Hash: 02e1d77c3ccb30903b52678b667e9c3459a289433f573f3f4bd9c8dd8e71072e
Instruction Fuzzy Hash: 2D218F71904618EADB209FA1CD88BEE77BCFF44734F108616E929EA194D7708985CF50

Function 0093990E Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009398CC
SetTextColor.GDI32(?,?), ref: 009398D6
SetBkMode.GDI32(?,00000001), ref: 009398E9
GetStockObject.GDI32(00000005), ref: 009398F1
GetWindowLongW.USER32(?,000000EB), ref: 00939952

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: a3fb3f357aa92da347e35a69a2a89ed4af8ad27493f509f43d98835b53b81a0f
Instruction ID: af650cd7d8b055fd84b1c7b268834c099e3387038e047309a4af3fd2b462cb0c
Opcode Fuzzy Hash: a3fb3f357aa92da347e35a69a2a89ed4af8ad27493f509f43d98835b53b81a0f
Instruction Fuzzy Hash: E021F63168D2909FC7128F79AC55BE93B699F53330F08026DF5968B1E2C7754841DF51

Function 009A0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 009A0951
GetForegroundWindow.USER32 ref: 009A0968
GetDC.USER32(00000000), ref: 009A09A4
GetPixel.GDI32(00000000,?,00000003), ref: 009A09B0
ReleaseDC.USER32(00000000,00000003), ref: 009A09E8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 7b735a576c6a86bc964e59d55d0baa59f13822f899b25027f561582064c8a7fb
Instruction ID: dc71cc37e938d2b320889486c77c07fda2ee0f502489ea440943e45b521731e6
Opcode Fuzzy Hash: 7b735a576c6a86bc964e59d55d0baa59f13822f899b25027f561582064c8a7fb
Instruction Fuzzy Hash: 1E21A175600214AFD704EF69D984EAEBBE9EF89750F04812CF84A97362CB30AC04DB90

Function 0095CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0095CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0095CDE9

Part of subcall function 00953820: RtlAllocateHeap.NTDLL(00000000,?,009F1444,?,0093FDF5,?,?,0092A976,00000010,009F1440,009213FC,?,009213C6,?,00921129), ref: 00953852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0095CE0F
_free.LIBCMT ref: 0095CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0095CE31

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 4fc1b938d1c7b8e648e444b79cce21171f55e267f56fe9e0a40077fd273b0ec4
Instruction ID: 7df996966969c57f3442a0ea338a46469cf29e4771f4754e17d9b62d0ab26739
Opcode Fuzzy Hash: 4fc1b938d1c7b8e648e444b79cce21171f55e267f56fe9e0a40077fd273b0ec4
Instruction Fuzzy Hash: 7501A7F26053157F232196BB6C8ED7F7A6DDEC6BA23150229FD05D7201EA618D0993B0

Function 00939639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00939693
SelectObject.GDI32(?,00000000), ref: 009396A2
BeginPath.GDI32(?), ref: 009396B9
SelectObject.GDI32(?,00000000), ref: 009396E2

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 4c82b71b55e9ac101f64e7f76fb1b22d49b49202a4696643c99b7763c7363e75
Instruction ID: d90c4b5ff7ceb118691309ad67a74515625b486f956acda88ff5d7cb35036c44
Opcode Fuzzy Hash: 4c82b71b55e9ac101f64e7f76fb1b22d49b49202a4696643c99b7763c7363e75
Instruction Fuzzy Hash: 3221BE7082A305EBDB109F68FD197B93BA8BB10369F100216F810A61B0C3F09881EFD0

Function 00985711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00985726
_memcmp.LIBVCRUNTIME ref: 00985744
_memcmp.LIBVCRUNTIME ref: 00985757
_memcmp.LIBVCRUNTIME ref: 0098576F
_memcmp.LIBVCRUNTIME ref: 00985787

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 133104e40bb010a36234c6ff29b67bb1dce4fd48dd5e3617470cffba97a9fd09
Instruction ID: 4c3030098e40171cbbac40e1cdab4708a74532b740d01d63c4aa07c1af8193d1
Opcode Fuzzy Hash: 133104e40bb010a36234c6ff29b67bb1dce4fd48dd5e3617470cffba97a9fd09
Instruction Fuzzy Hash: 6001D865641609BBE2086510DE92FFB735C9FA13A8F418034FD089F341F764EE5483E4

Function 00952DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0094F2DE,00953863,009F1444,?,0093FDF5,?,?,0092A976,00000010,009F1440,009213FC,?,009213C6), ref: 00952DFD
_free.LIBCMT ref: 00952E32
_free.LIBCMT ref: 00952E59
SetLastError.KERNEL32(00000000,00921129), ref: 00952E66
SetLastError.KERNEL32(00000000,00921129), ref: 00952E6F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 9c82af848eeb7d73c49991a459f421d32fe11fba87776549c43432eb78ec32cd
Instruction ID: d3cc70d3e3679055b062bab99b9f27a2ff8edf6c6d34d4221c45a69c415dbbaa
Opcode Fuzzy Hash: 9c82af848eeb7d73c49991a459f421d32fe11fba87776549c43432eb78ec32cd
Instruction Fuzzy Hash: 5401F472209A0067C612E7777D87E6B279DABD33B7B244529FC65A22D2EE249C0D5320

Function 0098000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0097FF41,80070057,?,?,?,0098035E), ref: 0098002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0097FF41,80070057,?,?), ref: 00980046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0097FF41,80070057,?,?), ref: 00980054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0097FF41,80070057,?), ref: 00980064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0097FF41,80070057,?,?), ref: 00980070

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 3b09ee233f43a06c0e3475cba56f414783220d37b36a35437c86c71b94087579
Instruction ID: 1c4eddf89acba7bb2be22637a0850012d3970d1f0587c76975cc07b5b64ee145
Opcode Fuzzy Hash: 3b09ee233f43a06c0e3475cba56f414783220d37b36a35437c86c71b94087579
Instruction Fuzzy Hash: F401A2B2610204BFDB515F68DD04BAA7AEDEF847A2F144228F905D6310D775DD44EBA0

Function 009810F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00981114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00980B9B,?,?,?), ref: 00981120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00980B9B,?,?,?), ref: 0098112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00980B9B,?,?,?), ref: 00981136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0098114D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 7fecc45743dcaf7032be8eede6bc75a0e7ae8d79806540c902a917e365f73e04
Instruction ID: 8787ac1e16655610609e70be7a402464c1ac00a022abeb141505077e5cbcb307
Opcode Fuzzy Hash: 7fecc45743dcaf7032be8eede6bc75a0e7ae8d79806540c902a917e365f73e04
Instruction Fuzzy Hash: 330169B5204205BFDB115FA8DD4DAAA3B6EEF893A0B200419FA41D3360DB31DC00AB60

Function 00980FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00980FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00980FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00980FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00980FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00981002

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 071a34cb26fb921f8dca270af0385c6a4c094333f26ed98b251ab704e56fa343
Instruction ID: dbb4ee2f4fb2ca1ae6f095dcd8d5cf31ff1862f513d853a98c9c5a4f68899eb4
Opcode Fuzzy Hash: 071a34cb26fb921f8dca270af0385c6a4c094333f26ed98b251ab704e56fa343
Instruction Fuzzy Hash: 10F0CDB5204301EBDB212FA8DD4DF563BADEF89762F100425FA05D7260CA30DC409B60

Function 00981014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0098102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00981036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00981045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0098104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00981062

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 4e0add8ee8f633e78bcb78c5b70cda24cfcd08cde2376dea541b4d41ba4dd3a0
Instruction ID: 3d0cc057c063952921c47092b7d2c36a9169d500f0083cc5f4785fc49c538cfa
Opcode Fuzzy Hash: 4e0add8ee8f633e78bcb78c5b70cda24cfcd08cde2376dea541b4d41ba4dd3a0
Instruction Fuzzy Hash: D3F06DB5214301EBDB216FA8ED49F573BADEF89761F100525FA45D7250CA70D8419B60

Function 0099030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0099017D,?,009932FC,?,00000001,00962592,?), ref: 00990324
CloseHandle.KERNEL32(?,?,?,?,0099017D,?,009932FC,?,00000001,00962592,?), ref: 00990331
CloseHandle.KERNEL32(?,?,?,?,0099017D,?,009932FC,?,00000001,00962592,?), ref: 0099033E
CloseHandle.KERNEL32(?,?,?,?,0099017D,?,009932FC,?,00000001,00962592,?), ref: 0099034B
CloseHandle.KERNEL32(?,?,?,?,0099017D,?,009932FC,?,00000001,00962592,?), ref: 00990358
CloseHandle.KERNEL32(?,?,?,?,0099017D,?,009932FC,?,00000001,00962592,?), ref: 00990365

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: f4a40202d33bbcc10ad388df949d27221cf1acf1ac65f03a009eff092e61e3e7
Instruction ID: dc6c05bba481105ee26b992947338bce449e823ed6af0e31c0ab6626da46d061
Opcode Fuzzy Hash: f4a40202d33bbcc10ad388df949d27221cf1acf1ac65f03a009eff092e61e3e7
Instruction Fuzzy Hash: 4D01AE72800B159FCB30AF6AD881812FBF9BFA03153158A3FD1A652931C3B1A958DF80

Function 0095D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0095D752

Part of subcall function 009529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0095D7D1,00000000,00000000,00000000,00000000,?,0095D7F8,00000000,00000007,00000000,?,0095DBF5,00000000), ref: 009529DE
Part of subcall function 009529C8: GetLastError.KERNEL32(00000000,?,0095D7D1,00000000,00000000,00000000,00000000,?,0095D7F8,00000000,00000007,00000000,?,0095DBF5,00000000,00000000), ref: 009529F0

_free.LIBCMT ref: 0095D764
_free.LIBCMT ref: 0095D776
_free.LIBCMT ref: 0095D788
_free.LIBCMT ref: 0095D79A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f4c29d3106acc64f9d53f5df1aef5b3e56fa93c7163ac11073ace1e3abb0d879
Instruction ID: 36ff29288a344c8f90bb66286cbdcee4078281933faaef8a57f574d78119613b
Opcode Fuzzy Hash: f4c29d3106acc64f9d53f5df1aef5b3e56fa93c7163ac11073ace1e3abb0d879
Instruction Fuzzy Hash: 73F096B2515248AB8635EB66FAC1D567BDDBB493127A40C05FC88EB602C730FC848760

Function 00985C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00985C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00985C6F
MessageBeep.USER32(00000000), ref: 00985C87
KillTimer.USER32(?,0000040A), ref: 00985CA3
EndDialog.USER32(?,00000001), ref: 00985CBD

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: e29cf80b75e54ca0b2ea8ed73dbc482a1549aa8cda1b62a73d2486e5f6b6ead5
Instruction ID: e4a2693658860a88fb1a42a7c48bba14ba36a6dc22332fbfaa9202c733c919f9
Opcode Fuzzy Hash: e29cf80b75e54ca0b2ea8ed73dbc482a1549aa8cda1b62a73d2486e5f6b6ead5
Instruction Fuzzy Hash: C4018170514B04EBEB216B10EE4EFA677B8BB00B05F011659A5C3A15E1DBF4A9889F90

Function 009522A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 009522BE

Part of subcall function 009529C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0095D7D1,00000000,00000000,00000000,00000000,?,0095D7F8,00000000,00000007,00000000,?,0095DBF5,00000000), ref: 009529DE
Part of subcall function 009529C8: GetLastError.KERNEL32(00000000,?,0095D7D1,00000000,00000000,00000000,00000000,?,0095D7F8,00000000,00000007,00000000,?,0095DBF5,00000000,00000000), ref: 009529F0

_free.LIBCMT ref: 009522D0
_free.LIBCMT ref: 009522E3
_free.LIBCMT ref: 009522F4
_free.LIBCMT ref: 00952305

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8beb60ee5fa10eb36b22c44c2113b21c796bcf5d4068ed08fbb6ac1539f6136d
Instruction ID: 1409742e3593478c2f6f58c6f1482065a57ea8995e8f181867ea566da8595b6d
Opcode Fuzzy Hash: 8beb60ee5fa10eb36b22c44c2113b21c796bcf5d4068ed08fbb6ac1539f6136d
Instruction Fuzzy Hash: 99F054B44381119BC612EF95BD519A83F68F759752B000506F830E6372C7310816FFE4

Function 009395C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 009395D4
StrokeAndFillPath.GDI32(?,?,009771F7,00000000,?,?,?), ref: 009395F0
SelectObject.GDI32(?,00000000), ref: 00939603
DeleteObject.GDI32 ref: 00939616
StrokePath.GDI32(?), ref: 00939631

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: b7add822fd3172ee4b42a944379012c2c3d592620dae78e77fa2070ac5a834bf
Instruction ID: baa7a30c45c99871f7b6c1a42ff1610e0976ca43f6491bd480263c136bf5a698
Opcode Fuzzy Hash: b7add822fd3172ee4b42a944379012c2c3d592620dae78e77fa2070ac5a834bf
Instruction Fuzzy Hash: 75F0193002E204EBDB126F69EE187793B65AB1137AF048314F865550F0C7B089D1EFA0

Function 00950F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 009510F9
__freea.LIBCMT ref: 00951117

Part of subcall function 00951537: _free.LIBCMT ref: 0095154F

Strings

am/pm, xrefs: 0095117A
a/p, xrefs: 009511DE

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: dd12161a3a5d2366ae690d409e94ed26cbbe2ad93e966c76a0d80f126ab9455b
Instruction ID: 73353a6f9c1c2b15a2328ca63632175215b8c47e41790f0f54c558a563b4ca22
Opcode Fuzzy Hash: dd12161a3a5d2366ae690d409e94ed26cbbe2ad93e966c76a0d80f126ab9455b
Instruction Fuzzy Hash: F0D15A31904206DBCB28DF6AC8A5BFEB7B8FF05702F244559ED119B650D3399D88CB91

Function 009A7B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00940242: EnterCriticalSection.KERNEL32(009F070C,009F1884,?,?,0093198B,009F2518,?,?,?,009212F9,00000000), ref: 0094024D
Part of subcall function 00940242: LeaveCriticalSection.KERNEL32(009F070C,?,0093198B,009F2518,?,?,?,009212F9,00000000), ref: 0094028A

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

Part of subcall function 009400A3: __onexit.LIBCMT ref: 009400A9

__Init_thread_footer.LIBCMT ref: 009A7BFB

Part of subcall function 009401F8: EnterCriticalSection.KERNEL32(009F070C,?,?,00938747,009F2514), ref: 00940202
Part of subcall function 009401F8: LeaveCriticalSection.KERNEL32(009F070C,?,00938747,009F2514), ref: 00940235

Strings

Variable must be of type 'Object'., xrefs: 009A7C3A
G, xrefs: 009A7C7F
5, xrefs: 009A7C78

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 5fab49624832fa0a2220fd7a86c703777a758a5b5f5f391242cf808ea8b0f2dd
Instruction ID: 98e190cd8820efe3e8df42fb41b65ea51812462a933d9358adb25ece26635d2e
Opcode Fuzzy Hash: 5fab49624832fa0a2220fd7a86c703777a758a5b5f5f391242cf808ea8b0f2dd
Instruction Fuzzy Hash: E2919C70A04209EFCB14EF94D892EBDB7B5FF8A300F148459F8469B291DB71AE41CB91

Function 00982716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0098B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009821D0,?,?,00000034,00000800,?,00000034), ref: 0098B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00982760

Part of subcall function 0098B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009821FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0098B3F8

Part of subcall function 0098B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0098B355
Part of subcall function 0098B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00982194,00000034,?,?,00001004,00000000,00000000), ref: 0098B365
Part of subcall function 0098B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00982194,00000034,?,?,00001004,00000000,00000000), ref: 0098B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 009827CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0098281A

Strings

@, xrefs: 00982832

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 3a4607c797860fa2adaa0ad2f2f01e9ae30b147f45fc67f7ffef60b5518f574b
Instruction ID: 653af4a164a80ae35b7775574219028681051328219cb21d9000dc8216acc5b2
Opcode Fuzzy Hash: 3a4607c797860fa2adaa0ad2f2f01e9ae30b147f45fc67f7ffef60b5518f574b
Instruction Fuzzy Hash: 7F413C72900218BFDB10EBA4CD46FEEBBB8AF49300F144055FA55B7291DB706E45CBA0

Function 0095172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00951769
_free.LIBCMT ref: 00951834
_free.LIBCMT ref: 0095183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00951760, 00951767, 00951796, 009517CE

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1957095476
Opcode ID: f24d52108077801f2cfc3196cae77fda598dea423d5e959e3f58373deff62a11
Instruction ID: 9a65d6616816d54bfa10854f18d137fdf5c3c394bb0d83509a86aed3d411393c
Opcode Fuzzy Hash: f24d52108077801f2cfc3196cae77fda598dea423d5e959e3f58373deff62a11
Instruction Fuzzy Hash: F0319075A04218EFDB21DF9ADC81EAEBBFCEB89311B104166FD14D7211D6B08E48DB90

Function 0098C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0098C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0098C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,009F1990,01905498), ref: 0098C395

Strings

0, xrefs: 0098C2DF

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: aa3cbb597aec89a9722076f8efe9b1660437807b904949b91d4184f4e64afca1
Instruction ID: 9ae209105d82d1cdaca3d7986b964c716fb82a8304c989192857505b84dfb790
Opcode Fuzzy Hash: aa3cbb597aec89a9722076f8efe9b1660437807b904949b91d4184f4e64afca1
Instruction Fuzzy Hash: DB41A2B12083019FD720EF25D844B5ABBE8EF85321F148A1EF9A6973D1D770E905CB62

Function 009B4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,009BCC08,00000000,?,?,?,?), ref: 009B44AA
GetWindowLongW.USER32 ref: 009B44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 009B44D7

Strings

SysTreeView32, xrefs: 009B447C

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 0ba5772f3d6ea9c1ad7df9e96dc15f40b2b45d6ecf96f1f7e0d7d658bcdcf2a2
Instruction ID: 42ab9cd85efec5b511a4610be4ef9247a04061b12cf21ede66be965961535692
Opcode Fuzzy Hash: 0ba5772f3d6ea9c1ad7df9e96dc15f40b2b45d6ecf96f1f7e0d7d658bcdcf2a2
Instruction Fuzzy Hash: 2031CD71214605AFDF208E38DD45BEA7BAAEB48334F204715F975921E1D770EC60AB60

Function 009A304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009A335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,009A3077,?,?), ref: 009A3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 009A307A
_wcslen.LIBCMT ref: 009A309B
htons.WSOCK32(00000000,?,?,00000000), ref: 009A3106

Strings

255.255.255.255, xrefs: 009A3095, 009A309A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: b76fdbf750debc8664d2c86b1b0e047e01fca834ce85f192560ca042c0b61ef1
Instruction ID: 99c2e7f85590f453be93c97d003bd4fbc22fdf71520f23c8bd7226187d59bff3
Opcode Fuzzy Hash: b76fdbf750debc8664d2c86b1b0e047e01fca834ce85f192560ca042c0b61ef1
Instruction Fuzzy Hash: 1431E2792042159FCB20CF69C586FAA77E4EF56318F24C459F8158B392DB32EE41C7A0

Function 009B3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 009B3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 009B3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 009B3F78

Strings

SysMonthCal32, xrefs: 009B3F0B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 67d8c60c16971fc128482dd87ea7314fd9c881d590cdca9847deaea3806cfbce
Instruction ID: 0a056fb7aae16081c9e14cd38513c6dfdc8a62dedbe2379e8d644eed3c6fcdc6
Opcode Fuzzy Hash: 67d8c60c16971fc128482dd87ea7314fd9c881d590cdca9847deaea3806cfbce
Instruction Fuzzy Hash: 9B21BC32610219BBEF21CF90CD46FEA3B79EB88724F114214FA156B1D0D6B1AC50DBA0

Function 009B4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 009B4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 009B4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 009B471A

Strings

msctls_updown32, xrefs: 009B4684

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 341ca02d970c6f731fdf963854dda679530830ddc4a77f1c25286f869bde9a17
Instruction ID: b3375483de47496ad6a21ea4697f7a30c7e2b27e1535d4e42ebb1a10124e8ea4
Opcode Fuzzy Hash: 341ca02d970c6f731fdf963854dda679530830ddc4a77f1c25286f869bde9a17
Instruction Fuzzy Hash: 672171B5605209AFDB10DF64DDC1DB737ADEF9A3A4B040459FA009B251CB71EC51EAA0

Function 009895AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0098961D

Strings

#requireadmin, xrefs: 009895D9
#OnAutoItStartRegister, xrefs: 009895F3
#notrayicon, xrefs: 009895B7

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 1f7589c9079f52318018397f15a6b84d1293342e571fc634ae685c1ecafcabf1
Instruction ID: bd5d7f308d3d074bf1cf6231d2f5edc50147bfcae71db6e354b3a964dc304de6
Opcode Fuzzy Hash: 1f7589c9079f52318018397f15a6b84d1293342e571fc634ae685c1ecafcabf1
Instruction Fuzzy Hash: F1215732204620A6C331BB24DC16FBBB3DC9FD1714F18442AF9499B281FB55AE41C395

Function 009B37B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 009B3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 009B3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 009B3876

Strings

Listbox, xrefs: 009B380F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: f6694b69c2124ffa5b4e69e30846ca7ce01c7233011b20b16af0722422eda19d
Instruction ID: 5a037611fe1cada82b3ba900debdc6d9f369796329e54187be1a56509dfc51c4
Opcode Fuzzy Hash: f6694b69c2124ffa5b4e69e30846ca7ce01c7233011b20b16af0722422eda19d
Instruction Fuzzy Hash: FF21AC72610218BBEB21CEA5DD85FFB376EEF89764F108124F9009B190CA719C5287A0

Function 009949F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00994A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00994A5C
SetErrorMode.KERNEL32(00000000,?,?,009BCC08), ref: 00994AD0

Strings

%lu, xrefs: 00994A6F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: fae446b831384c2fe0e1b14b29c1da3a25568728b713b04679826a2d267bd429
Instruction ID: ad08fb39488983c6024261d93591b1001763e1e4a9f2ffce907c99224dcdad0c
Opcode Fuzzy Hash: fae446b831384c2fe0e1b14b29c1da3a25568728b713b04679826a2d267bd429
Instruction Fuzzy Hash: BC318571A00108AFDB11DF58C985EAABBF8EF48318F1440A5F509EB352D771ED46CB61

Function 009B41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 009B424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 009B4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 009B4271

Strings

msctls_trackbar32, xrefs: 009B4226

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 80fd270060940d6d83e600c393a6ebb9873fa67c78f114bc7c908b2b28837a95
Instruction ID: 8f928a152a59d8eec2640435784bc6faef20fcf4b54752341e5978f5872ba5b0
Opcode Fuzzy Hash: 80fd270060940d6d83e600c393a6ebb9873fa67c78f114bc7c908b2b28837a95
Instruction Fuzzy Hash: 1511E371240248BEEF205E69CD06FEB3BACEF95B64F010514FA55E20A1D271DC51AB50

Function 00982F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00926B57: _wcslen.LIBCMT ref: 00926B6A

Part of subcall function 00982DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00982DC5
Part of subcall function 00982DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00982DD6
Part of subcall function 00982DA7: GetCurrentThreadId.KERNEL32 ref: 00982DDD
Part of subcall function 00982DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00982DE4

GetFocus.USER32 ref: 00982F78

Part of subcall function 00982DEE: GetParent.USER32(00000000), ref: 00982DF9

GetClassNameW.USER32(?,?,00000100), ref: 00982FC3
EnumChildWindows.USER32(?,0098303B), ref: 00982FEB

Strings

%s%d, xrefs: 00982FFF

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 26dad6115bd9a33bb849302521ed1e8d542d37a91f4beffa8ef17295a56a95c3
Instruction ID: 8e7a0cd9b91ef36e4ff0d71502f0de275b3ec9a5a785ec17cf2011e48c1e2e25
Opcode Fuzzy Hash: 26dad6115bd9a33bb849302521ed1e8d542d37a91f4beffa8ef17295a56a95c3
Instruction Fuzzy Hash: AB11B1B5600205ABCF157F709C95FEE3B6AAFD4718F048079F909AB292DE3099499B70

Function 009B5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 009B58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 009B58EE
DrawMenuBar.USER32(?), ref: 009B58FD

Strings

0, xrefs: 009B588F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: e4caa64f9b2e9dd4603f788913e100cfcf62d0902653213335ee75c7316b7251
Instruction ID: 35cea060907ff5d640b78529a2914dc603780385cb892696d3d53cb1b31e64de
Opcode Fuzzy Hash: e4caa64f9b2e9dd4603f788913e100cfcf62d0902653213335ee75c7316b7251
Instruction Fuzzy Hash: F701AD32504208EFDB209F11DC44BEEBBB8FB45770F0480AAF848D6161DB308A80EF20

Function 0097D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0097D3BF
FreeLibrary.KERNEL32 ref: 0097D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 0097D3B9
X64, xrefs: 0097D2A8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 225e6bf7c287d91ee4649f3652b6492219377e32caaab774f4ed11efbeda368d
Instruction ID: 6efa93d93322d38957637163cd176b35bcc5b42f807dc68dabba95f37d2425f1
Opcode Fuzzy Hash: 225e6bf7c287d91ee4649f3652b6492219377e32caaab774f4ed11efbeda368d
Instruction Fuzzy Hash: A2F055A380B7209BD33112104C68AAD7378AF00B01F55CA15F80EF1146EB64CC428692

Function 0098007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a55e5199b5358c3ae303573d667ce0e5db9d07b7795c3d4ad785cf4ee912ee27
Instruction ID: f36ef670aa82f59733c225c9575a35775232cf0e8c22c04eef1edf6269142a1a
Opcode Fuzzy Hash: a55e5199b5358c3ae303573d667ce0e5db9d07b7795c3d4ad785cf4ee912ee27
Instruction Fuzzy Hash: F5C16A75A0020AEFDB54DFA4C898AAEB7B9FF88314F108599E405EB351C771EE45CB90

Function 00953E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00953F0B
__alldvrm.LIBCMT ref: 0095410C
__alldvrm.LIBCMT ref: 0095412E

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: efc2a9a8688e57a80371f4ac18f5c5fb8ad82bc6576538cd3eb614ed25e8b8da
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 86A17C71D047869FEB11CF2AC8917BEBBE8EF61395F28416DED459B281C2388D89C750

Function 009A342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 009A3459
CoUninitialize.OLE32 ref: 009A3463
VariantInit.OLEAUT32(?), ref: 009A346E
VariantClear.OLEAUT32(?), ref: 009A371B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: c2090d60189e371c0869a4fee462310047a44204b2d2b5d77e368f1103697851
Instruction ID: 3953a5eae3780361e47afe5cd680750b718f42dc44464892e92047ed1e90a5e9
Opcode Fuzzy Hash: c2090d60189e371c0869a4fee462310047a44204b2d2b5d77e368f1103697851
Instruction Fuzzy Hash: C7A138756043109FCB10DF68C585E2AB7E9FF89714F148859F98AAB366DB30EE01CB91

Function 00980436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,009BFC08,?), ref: 009805F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,009BFC08,?), ref: 00980608
CLSIDFromProgID.OLE32(?,?,00000000,009BCC40,000000FF,?,00000000,00000800,00000000,?,009BFC08,?), ref: 0098062D
_memcmp.LIBVCRUNTIME ref: 0098064E

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: dbefc939b3969e229620e3c04d98bd25a11fd161b98936fc0b48fc5700fa373b
Instruction ID: 2b68bd50109b6f7160e48ade116087b92e394c9082cdaa4684df7158ea9ba83b
Opcode Fuzzy Hash: dbefc939b3969e229620e3c04d98bd25a11fd161b98936fc0b48fc5700fa373b
Instruction Fuzzy Hash: 0F810971A00109EFCB44DF94C984EEEB7B9FF89315F204558F506AB250DB71AE0ACB60

Function 00961391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009614C0

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e26f43c1b7625e971373afca1f94f29bd77f292de0dc98d137cefce7267f4285
Instruction ID: fb310fa5d64153fa671b8f0ce8f1d97a72a84369b0cfbc50de115e11112256b9
Opcode Fuzzy Hash: e26f43c1b7625e971373afca1f94f29bd77f292de0dc98d137cefce7267f4285
Instruction Fuzzy Hash: 01412D31900111ABDB25BBB98C46BBE3BA8EF81370F1C4625F819D72B2EA7489415761

Function 009B6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 009B62E2
ScreenToClient.USER32(?,?), ref: 009B6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 009B6382

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 0320d9161585ddd758142b42432a93b5a288485a5531cb086feaeb84f7e58aff
Instruction ID: 266a70bf3587fb041feb37d746d5d99dd86dd512654b88fd0cfab32218e213c7
Opcode Fuzzy Hash: 0320d9161585ddd758142b42432a93b5a288485a5531cb086feaeb84f7e58aff
Instruction Fuzzy Hash: 32512B74900209EFDB10DF58DA80AEE7BF9EB55360F108269F955972A0D734ED81DB90

Function 009A1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 009A1AFD
WSAGetLastError.WSOCK32 ref: 009A1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 009A1B8A
WSAGetLastError.WSOCK32 ref: 009A1B94

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 3f77aa6e139b00092d9f2b3c16c811f73ab1fd5207f94964e2686f490045e84b
Instruction ID: a19258a92971a26e20cfc55da69968c86a43d5563139f5dfcf063a8d220c17e1
Opcode Fuzzy Hash: 3f77aa6e139b00092d9f2b3c16c811f73ab1fd5207f94964e2686f490045e84b
Instruction Fuzzy Hash: 3E41E274600210AFE720AF20D88AF2977E5EF89718F548448F91A9F7D6D772DD418BD0

Function 0095B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b18cea50ac3ce784f38895d7c84d17f0b5ab6a1bb1be344ca576b8620aaf7a3
Instruction ID: 3a309da060c040427ecdc3d5e97d710dfd7d8b0720a5a05d1477089dada208a4
Opcode Fuzzy Hash: 9b18cea50ac3ce784f38895d7c84d17f0b5ab6a1bb1be344ca576b8620aaf7a3
Instruction Fuzzy Hash: 72410472A00314AFD724DF39CC41BAABBE9EBC8711F20452EF956DB692D771A9058780

Function 009956D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00995783
GetLastError.KERNEL32(?,00000000), ref: 009957A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 009957CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 009957FA

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 1cbec4dd8469f81beeb552427be0512f83b1ed8ba70a4c056a29359337ea92a8
Instruction ID: db409b5b3c9da1d78ade86ca36d2229bd83d6bbc4d7331af1ac591134544137f
Opcode Fuzzy Hash: 1cbec4dd8469f81beeb552427be0512f83b1ed8ba70a4c056a29359337ea92a8
Instruction Fuzzy Hash: 25410939600620DFCF11EF55D544A5EFBE6AF89320B198488F84AAB366CB34FD40DB91

Function 0095D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00946D71,00000000,00000000,009482D9,?,009482D9,?,00000001,00946D71,8BE85006,00000001,009482D9,009482D9), ref: 0095D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0095D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0095D9AB
__freea.LIBCMT ref: 0095D9B4

Part of subcall function 00953820: RtlAllocateHeap.NTDLL(00000000,?,009F1444,?,0093FDF5,?,?,0092A976,00000010,009F1440,009213FC,?,009213C6,?,00921129), ref: 00953852

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 5ad4f2f1f00411d6cace885792e8bc3011498552daf0d4eb4187b6245b584a81
Instruction ID: 1cb95a60876752337d69a7dabad67fc417857facc0decc502393f7b3e52f263b
Opcode Fuzzy Hash: 5ad4f2f1f00411d6cace885792e8bc3011498552daf0d4eb4187b6245b584a81
Instruction Fuzzy Hash: 4831F272A1220AABDF24DF66DC51EAE7BA9EF41711F054268FC04E7150EB35CD58CB90

Function 009B52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 009B5352
GetWindowLongW.USER32(?,000000F0), ref: 009B5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 009B5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 009B53A8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: dc7a412d4316b30c8798c686f8c09359600fdf0c28a7159b331a5899592b2bd9
Instruction ID: c9ec32f23a5943a8d9573fd65863ec7ec79dbaa2c0de068d4be342d6db8af05f
Opcode Fuzzy Hash: dc7a412d4316b30c8798c686f8c09359600fdf0c28a7159b331a5899592b2bd9
Instruction Fuzzy Hash: 0231D270A65A08EFEB309E54CE05FE877E9AB043B0F594101FA11963E0C7F59980EB81

Function 0098AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 0098ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0098AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0098AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 0098ACC6

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: e40bdc8c40a7d728c19cd2b05430ea8887c7ad11eaaf4a1aa4a65251e0135bfa
Instruction ID: ce469472286546add02a4d70510b5dee844391aaf1ffe5021aed5b546f940b6e
Opcode Fuzzy Hash: e40bdc8c40a7d728c19cd2b05430ea8887c7ad11eaaf4a1aa4a65251e0135bfa
Instruction Fuzzy Hash: 65310870A04718AFFF35EB658C05BFA7BA9AB89320F08471BE4C5523D1C3798D859752

Function 009B7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 009B769A
GetWindowRect.USER32(?,?), ref: 009B7710
PtInRect.USER32(?,?,009B8B89), ref: 009B7720
MessageBeep.USER32(00000000), ref: 009B778C

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 404a92ecb8099457c77bd8f4bdba53cbb371937dd724b08c78baa58359833435
Instruction ID: c38ee679c14cfd67dabefbc667250e49061ace2e6641ba5739b39b53fd9c9e94
Opcode Fuzzy Hash: 404a92ecb8099457c77bd8f4bdba53cbb371937dd724b08c78baa58359833435
Instruction Fuzzy Hash: DD419C34A09215DFCB11CF98DAD4EE9B7F8FB89320F1542A8E4159B261CB70E941DB90

Function 009B16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 009B16EB

Part of subcall function 00983A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00983A57
Part of subcall function 00983A3D: GetCurrentThreadId.KERNEL32 ref: 00983A5E
Part of subcall function 00983A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009825B3), ref: 00983A65

GetCaretPos.USER32(?), ref: 009B16FF
ClientToScreen.USER32(00000000,?), ref: 009B174C
GetForegroundWindow.USER32 ref: 009B1752

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 77df27a44bf50bf92044410624421c74f4bf09296eb11bd20da53ab7f855b94e
Instruction ID: 382c914c553e5b1db3ed86b8cdb76a1b8e372f51ae51ba5ef96f16798de629e4
Opcode Fuzzy Hash: 77df27a44bf50bf92044410624421c74f4bf09296eb11bd20da53ab7f855b94e
Instruction Fuzzy Hash: 4D313EB1D00159AFCB04EFA9D9C1DEEBBFDEF88314B5080A9E415E7611DA319E45CBA0

Function 0098DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00927620: _wcslen.LIBCMT ref: 00927625

_wcslen.LIBCMT ref: 0098DFCB
_wcslen.LIBCMT ref: 0098DFE2
_wcslen.LIBCMT ref: 0098E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0098E018

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: e71c76a9d7b6cb78499da90003b8078cbd8bdb62ed3b04b58f56e4a51d9a24e2
Instruction ID: d39018e3b38e05bdaf6ddd1dbe8883652d109c1d7eda642af571ca7d144cf8c8
Opcode Fuzzy Hash: e71c76a9d7b6cb78499da90003b8078cbd8bdb62ed3b04b58f56e4a51d9a24e2
Instruction Fuzzy Hash: 8421A176D01214AFCB20AFA8D981FAEB7F8EF85750F144065E905FB385D6709E41CBA1

Function 0098D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0098D501
Process32FirstW.KERNEL32(00000000,?), ref: 0098D50F
Process32NextW.KERNEL32(00000000,?), ref: 0098D52F
CloseHandle.KERNEL32(00000000), ref: 0098D5DC

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 37ac77bfeb6b9c1daae6788be07d9708339f65794eec27b2df6ca0825ac6e825
Instruction ID: 1601103402b1e3e3e47afcd672a582c5c07a2781421c2cb0f33dccc95aab3c5c
Opcode Fuzzy Hash: 37ac77bfeb6b9c1daae6788be07d9708339f65794eec27b2df6ca0825ac6e825
Instruction Fuzzy Hash: C1319F721083009FD304EF54D881BAFBBE8EFD9354F14092DF585962A1EB71A948CBA2

Function 009B8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00939BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00939BB2

GetCursorPos.USER32(?), ref: 009B9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00977711,?,?,?,?,?), ref: 009B9016
GetCursorPos.USER32(?), ref: 009B905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00977711,?,?,?), ref: 009B9094

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: a352e177295fb5b208a326187aa6e957011a30c1074b468a898a8f9df4001e86
Instruction ID: 8a06e049f6d33dc3288cf8332520f40332dad1b693f4be6924069ee71f1157cd
Opcode Fuzzy Hash: a352e177295fb5b208a326187aa6e957011a30c1074b468a898a8f9df4001e86
Instruction Fuzzy Hash: D821A135621018FFCB259F94CD98FFA7BB9EF8A360F044155FA0547261C3719990EBA0

Function 0098D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,009BCB68), ref: 0098D2FB
GetLastError.KERNEL32 ref: 0098D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0098D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,009BCB68), ref: 0098D376

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: e0ab7df7d4831081b52779fd3c3da2bdf54f1934a33ef49e3cbce797bdeb14f4
Instruction ID: 0d204dd678b6d2b75f83e2d39b68ab23c8c9fbdbb3cc3b1c7712377e5d8c1514
Opcode Fuzzy Hash: e0ab7df7d4831081b52779fd3c3da2bdf54f1934a33ef49e3cbce797bdeb14f4
Instruction Fuzzy Hash: CA21917050A3119F8700EF24D98196EB7E8AF9A368F104A1EF499C73E1D730DA45CB93

Function 00981571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00981014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0098102A
Part of subcall function 00981014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00981036
Part of subcall function 00981014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00981045
Part of subcall function 00981014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0098104C
Part of subcall function 00981014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00981062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 009815BE
_memcmp.LIBVCRUNTIME ref: 009815E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00981617
HeapFree.KERNEL32(00000000), ref: 0098161E

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 222cb0216b74da5202f941a295d73ba3661523baa93c437bb92dca32c30d7645
Instruction ID: 8d16a278294d9c90e533a4ff30aba7075179271293b437cfdb7ab5a12d4a9423
Opcode Fuzzy Hash: 222cb0216b74da5202f941a295d73ba3661523baa93c437bb92dca32c30d7645
Instruction Fuzzy Hash: 8F214871E10109EFDF14EFA4C945BEEB7BCEF84354F184459E481AB241E730AA46DBA0

Function 009B2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 009B280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 009B2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 009B2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 009B2840

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 36aaca2103be1b84b484df3ecd4e6d7e3df1ff9c1a53afab342bb5870c4b4935
Instruction ID: a4796d2c56ec1b6b74f83b12b5186afb08244c7626e51538efafc8eb89f04aff
Opcode Fuzzy Hash: 36aaca2103be1b84b484df3ecd4e6d7e3df1ff9c1a53afab342bb5870c4b4935
Instruction Fuzzy Hash: E021B031208511AFD7149B24C985FEA7B99EF86334F148258F4268B6E2CB75FC82CBD0

Function 009878F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00988D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0098790A,?,000000FF,?,00988754,00000000,?,0000001C,?,?), ref: 00988D8C
Part of subcall function 00988D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00988DB2
Part of subcall function 00988D7D: lstrcmpiW.KERNEL32(00000000,?,0098790A,?,000000FF,?,00988754,00000000,?,0000001C,?,?), ref: 00988DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00988754,00000000,?,0000001C,?,?,00000000), ref: 00987923
lstrcpyW.KERNEL32(00000000,?), ref: 00987949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00988754,00000000,?,0000001C,?,?,00000000), ref: 00987984

Strings

cdecl, xrefs: 0098797B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: b69e3eff3a05862604fd13610d979756b4c7d64882deff5765043b47aa4eff4a
Instruction ID: 128fd0432e706b7f51104865f4d69a0c3713063a8fb7ccd17e394d3a76c62722
Opcode Fuzzy Hash: b69e3eff3a05862604fd13610d979756b4c7d64882deff5765043b47aa4eff4a
Instruction Fuzzy Hash: C711D63A204242AFCB15AF79D845E7BB7A9FF85390B50402AF946C73A4EF32D811D761

Function 009B7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 009B7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 009B7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 009B7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0099B7AD,00000000), ref: 009B7D6B

Part of subcall function 00939BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00939BB2

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: b1c8d0820bd56f5ab4820ea950e91a956958fab3e8101fbb921cfe44502fb946
Instruction ID: aecff8e39c1305ad60a78e544c4d5a37039d197b681403f093b241482c9f0f87
Opcode Fuzzy Hash: b1c8d0820bd56f5ab4820ea950e91a956958fab3e8101fbb921cfe44502fb946
Instruction Fuzzy Hash: B911C031218615AFCB108F68DD04AB67BA8AFC53B0B214728F839D72F0D7309950DB90

Function 009B5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 009B56BB
_wcslen.LIBCMT ref: 009B56CD
_wcslen.LIBCMT ref: 009B56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 009B5816

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 1973281834fe60cf039696717dd0af14237fe1609925c35bc3232f02658e872e
Instruction ID: 9137e0eb808b3c0ded5da9d7315b4a83b842dfea06b92789c1c803bcdb4524b5
Opcode Fuzzy Hash: 1973281834fe60cf039696717dd0af14237fe1609925c35bc3232f02658e872e
Instruction Fuzzy Hash: 5211B171A00608EADB209F618E89FEE77ACEF50774B50452AF915D6081EB748A80CB60

Function 00951D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908235e65e14318ccc34adaa8d6a8460c4ce6a5241115018349137ed294050a6
Instruction ID: d7f43e0519e21f90e3dcd8d7a71db9f9c0755a528f678796259d7608bf47be40
Opcode Fuzzy Hash: 908235e65e14318ccc34adaa8d6a8460c4ce6a5241115018349137ed294050a6
Instruction Fuzzy Hash: D701A2B220961A3FF621A67A6CC1F67672CDF813BAF300725FD31611D2DB608C485360

Function 00981A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00981A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00981A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00981A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00981A8A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8c5ecf226f69740e0ef93b3b385926c8916fbb527082acf295cd9d959e6e1eaf
Instruction ID: b70831e81fd3e44ce4d4af5a088683a520d896d28d3f74623aaabc496762f77e
Opcode Fuzzy Hash: 8c5ecf226f69740e0ef93b3b385926c8916fbb527082acf295cd9d959e6e1eaf
Instruction Fuzzy Hash: CE11397AD01219FFEF10EBA4CD85FADBB78EB08750F200091EA10B7290D6716E51DB94

Function 0098E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0098E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0098E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0098E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0098E24D

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 574779ca57e709c5554734d3d20388e39d3b2c333a790e1704ec263925fa50c3
Instruction ID: 3967ad354980397b55755dffc77e45ef36fa58750676ea01a8925d8acec97b06
Opcode Fuzzy Hash: 574779ca57e709c5554734d3d20388e39d3b2c333a790e1704ec263925fa50c3
Instruction Fuzzy Hash: 4511D6B691C254BBC701AFA89C49AAE7FADAB85320F144365F924E3391D6B4CD04D7A0

Function 0094D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0094CFF9,00000000,00000004,00000000), ref: 0094D218
GetLastError.KERNEL32 ref: 0094D224
__dosmaperr.LIBCMT ref: 0094D22B
ResumeThread.KERNEL32(00000000), ref: 0094D249

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 8fa0e71890835b71fe40fef173b209be1b260b2beeb45688709c0d527dd20451
Instruction ID: 0b86cd0a7be33aab20f547cdda2b54945816f66a4d24e9845b108182c3ef8812
Opcode Fuzzy Hash: 8fa0e71890835b71fe40fef173b209be1b260b2beeb45688709c0d527dd20451
Instruction Fuzzy Hash: 7901D27A81A219BBCB215BA5DC09FAE7AADDFC2331F100319F935961D0CBB1C901D7A0

Function 009B9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00939BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00939BB2

GetClientRect.USER32(?,?), ref: 009B9F31
GetCursorPos.USER32(?), ref: 009B9F3B
ScreenToClient.USER32(?,?), ref: 009B9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 009B9F7A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: b8442225c8f2fd9cff497796b1e590d4ff33a25a16a0455b77d00c2af72c1af2
Instruction ID: 04d114b186842a1404a4c7ca173ce4d40fce9efed23c14fbf97b798be1d59323
Opcode Fuzzy Hash: b8442225c8f2fd9cff497796b1e590d4ff33a25a16a0455b77d00c2af72c1af2
Instruction Fuzzy Hash: F411367292411AEBDB10DFA8DA85AFE77B8EB46321F000555FA01E3150D770BE81DBA1

Function 0092600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0092604C
GetStockObject.GDI32(00000011), ref: 00926060
SendMessageW.USER32(00000000,00000030,00000000), ref: 0092606A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: f8eac0059d1973671b4f03cec6cf459e7aa6daea5e46178614b54130af348716
Instruction ID: 32a6644f1ba883787219c83e758940c534579e76e5b427594712f7a7d3b456d9
Opcode Fuzzy Hash: f8eac0059d1973671b4f03cec6cf459e7aa6daea5e46178614b54130af348716
Instruction Fuzzy Hash: A711ADB2146518FFEF124FA5AC44EEABB6DEF093A4F000201FA0452020C732DC60FBA0

Function 00943B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00943B56

Part of subcall function 00943AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00943AD2
Part of subcall function 00943AA3: ___AdjustPointer.LIBCMT ref: 00943AED

_UnwindNestedFrames.LIBCMT ref: 00943B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00943B7C
CallCatchBlock.LIBVCRUNTIME ref: 00943BA4

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 55c4c9b141ccc2f1e11631c0b4bd25125d43f356adb5cd37eb1e7d07bf69e233
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: E8010C32100149BBDF126EA5CC46FEB7F6DEF98754F048114FE58A6121D732E961DBA0

Function 00953073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,009213C6,00000000,00000000,?,0095301A,009213C6,00000000,00000000,00000000,?,0095328B,00000006,FlsSetValue), ref: 009530A5
GetLastError.KERNEL32(?,0095301A,009213C6,00000000,00000000,00000000,?,0095328B,00000006,FlsSetValue,009C2290,FlsSetValue,00000000,00000364,?,00952E46), ref: 009530B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0095301A,009213C6,00000000,00000000,00000000,?,0095328B,00000006,FlsSetValue,009C2290,FlsSetValue,00000000), ref: 009530BF

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 8755732f85eab08b4981125727b2ab36050802d13e329c7710172a8abe5cefd2
Instruction ID: b992db69d7068f05e63bed579a69f9937b45fd73aac24bfce215047d85fc49fd
Opcode Fuzzy Hash: 8755732f85eab08b4981125727b2ab36050802d13e329c7710172a8abe5cefd2
Instruction Fuzzy Hash: B201D472729322ABCB218B7A9C449677B9CAF45BF2B108B20FD15E3180C721D909D7E0

Function 00987464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0098747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00987497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 009874AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 009874CA

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 3cdd6ea652e65a80820d59759b319f99cd0c3df7fb21c43ab3455b62db0ba8c8
Instruction ID: 85ed27b0c0e3bf19a2f8c980e4fa715afbc1d8898075f9641ad1fe3af15d18dd
Opcode Fuzzy Hash: 3cdd6ea652e65a80820d59759b319f99cd0c3df7fb21c43ab3455b62db0ba8c8
Instruction Fuzzy Hash: AD11C4B22093149FE7209FA4DD08F92BFFDEB00B10F208969A656D6261D774E904DB60

Function 0098B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0098ACD3,?,00008000), ref: 0098B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0098ACD3,?,00008000), ref: 0098B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0098ACD3,?,00008000), ref: 0098B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0098ACD3,?,00008000), ref: 0098B126

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: d47162d5d188568694caea23ac5f4f179faffe2d1a8cf76543528b4ea81f9eaa
Instruction ID: 55fba2c66e21b5ac4907896cc9a19c687ba5ac11edb08ea52d3ee6d47db6dd9c
Opcode Fuzzy Hash: d47162d5d188568694caea23ac5f4f179faffe2d1a8cf76543528b4ea81f9eaa
Instruction Fuzzy Hash: A1118B70C0852CEBCF00EFE8E9A86EEBB78FF09321F044186D981B7285CB3496509B51

Function 009B7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 009B7E33
ScreenToClient.USER32(?,?), ref: 009B7E4B
ScreenToClient.USER32(?,?), ref: 009B7E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 009B7E8A

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: e40ab04f849387f1e9811fbe3e0af4b71d259fee51e64dcfaeb2a156e6ebe181
Instruction ID: 09945b320099e715d15fac36985b738268010ff86433a7fd1d1ed7e38f55333f
Opcode Fuzzy Hash: e40ab04f849387f1e9811fbe3e0af4b71d259fee51e64dcfaeb2a156e6ebe181
Instruction Fuzzy Hash: 981140B9D0420AAFDB41CF98C984AEEBBF9FF08310F509166E915E2210D735AA54DF90

Function 00982DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00982DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00982DD6
GetCurrentThreadId.KERNEL32 ref: 00982DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00982DE4

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: fcf1c1f1af85992b7a634b5bd1ac734e9c9eb043fc1d19d6a6b4b4931a17cc8b
Instruction ID: 0f46cc80e44ea45722ed578b3cb240b9501611868449ab1357a26612623a0f1e
Opcode Fuzzy Hash: fcf1c1f1af85992b7a634b5bd1ac734e9c9eb043fc1d19d6a6b4b4931a17cc8b
Instruction Fuzzy Hash: 52E092B2519224BBD7202B729D0DFEB3F6CEF42BB1F000215F505E11809AA4C840D7B0

Function 009B8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00939639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00939693
Part of subcall function 00939639: SelectObject.GDI32(?,00000000), ref: 009396A2
Part of subcall function 00939639: BeginPath.GDI32(?), ref: 009396B9
Part of subcall function 00939639: SelectObject.GDI32(?,00000000), ref: 009396E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 009B8887
LineTo.GDI32(?,?,?), ref: 009B8894
EndPath.GDI32(?), ref: 009B88A4
StrokePath.GDI32(?), ref: 009B88B2

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: a97c472be3b172dd3ba6ecafa00e42252a6940dffe6d97b421f84602a9a98400
Instruction ID: 4caed07433efdbccda0240a0afacf345b2daa12e26ea5122cb5d71568e4fbd1d
Opcode Fuzzy Hash: a97c472be3b172dd3ba6ecafa00e42252a6940dffe6d97b421f84602a9a98400
Instruction Fuzzy Hash: 6EF09A36019219FBDB122F94AD0AFDA3A1DAF0A320F008100FA11610E1C7B50550EFE5

Function 009398B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009398CC
SetTextColor.GDI32(?,?), ref: 009398D6
SetBkMode.GDI32(?,00000001), ref: 009398E9
GetStockObject.GDI32(00000005), ref: 009398F1

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 698e7e1096de4689268dd2f698ba75360ea91312ad2bac31b490accae77d6d5e
Instruction ID: 6e5da4eda748b1c98e73a916e044210b42c2706041d8f7d62efeaa47ba177207
Opcode Fuzzy Hash: 698e7e1096de4689268dd2f698ba75360ea91312ad2bac31b490accae77d6d5e
Instruction Fuzzy Hash: 90E0657225C240AADB215B78AD09BE87F15AB11335F04C319F6F9580E1C3714640AB10

Function 0098162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00981634
OpenThreadToken.ADVAPI32(00000000,?,?,?,009811D9), ref: 0098163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,009811D9), ref: 00981648
OpenProcessToken.ADVAPI32(00000000,?,?,?,009811D9), ref: 0098164F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 4ce26330149d895ecff061997ccea86e005e0a8faea7b948accd4ad45b5e7e08
Instruction ID: 67ed8160ae08ababfe374a56ceab72ae6eaafc4787c5453a62d67b956dcdf68c
Opcode Fuzzy Hash: 4ce26330149d895ecff061997ccea86e005e0a8faea7b948accd4ad45b5e7e08
Instruction Fuzzy Hash: FAE086B1615211DBDB202FA09F0DB863B7CAF447A1F184918F285D9080E7348441D760

Function 0097D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0097D858
GetDC.USER32(00000000), ref: 0097D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0097D882
ReleaseDC.USER32(?), ref: 0097D8A3

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: d313be58c753787fb464489e2b4bc8783c6337395c2cb56d07510517dde8feaf
Instruction ID: ed1373dce1b5d8373b76b656bbf7cd9cb623da318b12588e9f6a12ffe196b6d9
Opcode Fuzzy Hash: d313be58c753787fb464489e2b4bc8783c6337395c2cb56d07510517dde8feaf
Instruction Fuzzy Hash: CAE01AF5C18209DFCF41AFA4DA0CA6DBBB1FB48320F108509E806E7250C7385901AF50

Function 0097D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0097D86C
GetDC.USER32(00000000), ref: 0097D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0097D882
ReleaseDC.USER32(?), ref: 0097D8A3

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 6d69e73bc93da9cf10bfb8c251d93b8b93e08014f45785992dcae8ae3c97f4b3
Instruction ID: 78362e6e56a7e7cf56922475e721b03f970b9008a0ba225faa9e4fb7ee5fb31e
Opcode Fuzzy Hash: 6d69e73bc93da9cf10bfb8c251d93b8b93e08014f45785992dcae8ae3c97f4b3
Instruction Fuzzy Hash: DBE092B5C18209EFCF51AFA4EA0CA6DBBB5BB48321F148549E94AE7250CB385901AF50

Function 00994D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00927620: _wcslen.LIBCMT ref: 00927625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00994ED4

Strings

LPT, xrefs: 00994DFB
*, xrefs: 00994E10

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 29558f6c958258d9dc05c1602de03824c93750c81330246b8f7c41d17a7d3bfc
Instruction ID: d2127408bf5163c130cb25e41431cd47b6cbc9ddad289fd9c82078ba45f2af0b
Opcode Fuzzy Hash: 29558f6c958258d9dc05c1602de03824c93750c81330246b8f7c41d17a7d3bfc
Instruction Fuzzy Hash: 6E918075A002159FCB15DF58C484EAABBF5BF48304F188099F80A9F362D735ED86CB91

Function 0094E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0094E30D

Strings

pow, xrefs: 0094E2E5, 0094E302

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: c033e4f1c35abd49f8a5439010c575fca2f960fc1ce4cc98bee0abe63a17175e
Instruction ID: 130be1d5f3ba674ec58fd68c7cd9ea6cf1b94e89add1ed257c0d73c759fffe7a
Opcode Fuzzy Hash: c033e4f1c35abd49f8a5439010c575fca2f960fc1ce4cc98bee0abe63a17175e
Instruction Fuzzy Hash: 57519061E1C20296CB16FB55E902F79BBACBB40742F304D58E8D5422F9DB348D8D9B46

Function 0093E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0093E1B1

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 2f49aa28c546d2d28c4e88cb50e7396ae188aa9b1279ff9d66864c41f7114ceb
Instruction ID: 070945086df167ee7a93b4d2c153c5e070ad76d4ae47cb73b2f26576fcd6dba3
Opcode Fuzzy Hash: 2f49aa28c546d2d28c4e88cb50e7396ae188aa9b1279ff9d66864c41f7114ceb
Instruction Fuzzy Hash: 78514336904346DFDB19DF68C081AFA7BA8EF59310F248095F8A59B2D0D7349D42CBA0

Function 0093F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0093F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 0093F2BB

Strings

@, xrefs: 0093F2AF

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 119f0e439de4371ae177c6b9125e2bd7ec434365e0b309783703ee3f1b28505d
Instruction ID: 1f24c6e822e0f3f228976dcea69173d5ff95cd110f39cf59a7e5aee08b0b0e5f
Opcode Fuzzy Hash: 119f0e439de4371ae177c6b9125e2bd7ec434365e0b309783703ee3f1b28505d
Instruction Fuzzy Hash: 6651277241C744ABD320AF50E886BAFBBF8FBC4300F81885DF1D951199EB708569CB66

Function 009A5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 009A57E0
_wcslen.LIBCMT ref: 009A57EC

Strings

CALLARGARRAY, xrefs: 009A57E6, 009A57EB

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 489f791dfc893d333de642f708299346660dea23cd2e38ec516411ccc25042b4
Instruction ID: b6c004b0ebead9e470d70af8348824af22080f3f8b47391607e0e5459faaf46d
Opcode Fuzzy Hash: 489f791dfc893d333de642f708299346660dea23cd2e38ec516411ccc25042b4
Instruction Fuzzy Hash: 7C419371E002099FCB14DFA9C885ABEBBF9FF9A324F154069E505A7261E7349D81CF90

Function 0099D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0099D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0099D13A

Strings

|, xrefs: 0099D10B

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 72ee17828db60a14a3762a15d64aae725e54e17bfc7e5d8f32a3a679be111d00
Instruction ID: c6f472ed139c786e82619cffe1998af3418c4cf808889b235947e99867e431c0
Opcode Fuzzy Hash: 72ee17828db60a14a3762a15d64aae725e54e17bfc7e5d8f32a3a679be111d00
Instruction Fuzzy Hash: D9315B71D01219ABCF15EFA4DC85EEEBFB9FF45300F000019F819A6166EB31AA16DB60

Function 009B356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 009B3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 009B365C

Strings

static, xrefs: 009B35BC

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 9aa63c6ec1145e93fd55b848e67fe22185e802b3ec9575acd1f205109bef1ee7
Instruction ID: f6372430cf011cbdb8a3ef666317c36dec72047981ded8c7e130f10ac7b07914
Opcode Fuzzy Hash: 9aa63c6ec1145e93fd55b848e67fe22185e802b3ec9575acd1f205109bef1ee7
Instruction Fuzzy Hash: 97319E71110604AEDB24DF68DC81FFB73ADFF88724F008619F8A597280DA70AD81DB60

Function 009B4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 009B461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 009B4634

Strings

', xrefs: 009B458E

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 74cb5df6a27e65ce3719ae8750a5251b053d1387724c3b2fc6d58c30e43d48ce
Instruction ID: 28a05186b725091fb2e11f28c4a794b3126df86d6692f2deec302b1f4029b58a
Opcode Fuzzy Hash: 74cb5df6a27e65ce3719ae8750a5251b053d1387724c3b2fc6d58c30e43d48ce
Instruction Fuzzy Hash: 8A312774A0071ADFDB14CFA9CA80BEA7BB9FF49310F10406AE904AB342D770A941DF90

Function 009B31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 009B327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 009B3287

Strings

Combobox, xrefs: 009B3249

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 0850fdbe24d72b89ff3b1a58cbbe52dc80e9ae3ac947cfaa3a751d1da911cbf7
Instruction ID: df5c6d7250ce6575cd6c04615ac7756b2245b050d0e13e793955d6f0578cff69
Opcode Fuzzy Hash: 0850fdbe24d72b89ff3b1a58cbbe52dc80e9ae3ac947cfaa3a751d1da911cbf7
Instruction Fuzzy Hash: C811B271304208BFEF21DE94DD85EFB376EEB983B4F108228F92897290D6719D5197A0

Function 009B3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0092600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0092604C
Part of subcall function 0092600E: GetStockObject.GDI32(00000011), ref: 00926060
Part of subcall function 0092600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0092606A

GetWindowRect.USER32(00000000,?), ref: 009B377A
GetSysColor.USER32(00000012), ref: 009B3794

Strings

static, xrefs: 009B3757

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: eeee49a8c76f7dfda212dac458ece2cbec3753d2b62714b3eec1e31d390f42a0
Instruction ID: b902df489282f52d51f1ae6768849009da05e4b9dee0e4521dec35f856136690
Opcode Fuzzy Hash: eeee49a8c76f7dfda212dac458ece2cbec3753d2b62714b3eec1e31d390f42a0
Instruction Fuzzy Hash: 8E1129B2610209AFDB00DFA8CD85EEA7BB8EB08364F004A14F955E2250EB75E851DB60

Function 0099CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0099CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0099CDA6

Strings

<local>, xrefs: 0099CD66

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: fb5ad0cc7f363ff9fa1c7d9ac2ccf5284a0815305fabe736a3c6872873727a8a
Instruction ID: 3215e8b4410b20d382faa734efaae72394556318e6c6a80871420691dc1fe368
Opcode Fuzzy Hash: fb5ad0cc7f363ff9fa1c7d9ac2ccf5284a0815305fabe736a3c6872873727a8a
Instruction Fuzzy Hash: 7F11C2F1215631BADB384B6A8C89EE7BEACEF127B4F00462AB109930C0D7749840D6F0

Function 009B3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 009B34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 009B34BA

Strings

edit, xrefs: 009B348F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 8bef1c44dfe6b4b425a309b938e66d3d3423886134adeac83cc0404b65f3355b
Instruction ID: bb8b22c495e0cbffcfe8ec0b2c913d57fdb09bbaa1a6d97d9c09ad87c90e1d11
Opcode Fuzzy Hash: 8bef1c44dfe6b4b425a309b938e66d3d3423886134adeac83cc0404b65f3355b
Instruction Fuzzy Hash: 21118C71110208ABEB228F68DE84AFB376EEF45378F508724F961931E0C775DC91AB60

Function 00986C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

CharUpperBuffW.USER32(?,?,?), ref: 00986CB6
_wcslen.LIBCMT ref: 00986CC2

Strings

STOP, xrefs: 00986CBC, 00986CC1

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 0a9a5dbd3bf1b79829f381ee35eab7214cc5463d4a01c491aaeeb31a7cfe6504
Instruction ID: 03aa32377641f44fd206026272a5946214ba85e56b80e548cd7f0a542263bc59
Opcode Fuzzy Hash: 0a9a5dbd3bf1b79829f381ee35eab7214cc5463d4a01c491aaeeb31a7cfe6504
Instruction Fuzzy Hash: F601C4336105268BCB21BFBDDC80ABF77A9FBA1714B110924E9929A294EB35D900C750

Function 00981CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

Part of subcall function 00983CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00983CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00981D4C

Strings

ListBox, xrefs: 00981D16
ComboBox, xrefs: 00981CEB

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 855d9938f026564f5d1063d91e93544a70a280bff1e13234f5d194056a96c46b
Instruction ID: 7c7be54a1dd481b6548b809fedd6e3c1820664f94d2bf681894a9d29222c1b48
Opcode Fuzzy Hash: 855d9938f026564f5d1063d91e93544a70a280bff1e13234f5d194056a96c46b
Instruction Fuzzy Hash: CE01D475601228ABCB08FBA4DD55EFE73ACFB86350F040A19F866673C1EA30590987A0

Function 00981BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

Part of subcall function 00983CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00983CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00981C46

Strings

ListBox, xrefs: 00981C10
ComboBox, xrefs: 00981BE5

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: f4daaa47af858085f46922b44fd1cbe1e0e750cdeb02c8e2c3f05b22bb380c2a
Instruction ID: f950178c823bd14b4b77e0c719c9a795b91d8e8e075c6897b0156dc1d440346f
Opcode Fuzzy Hash: f4daaa47af858085f46922b44fd1cbe1e0e750cdeb02c8e2c3f05b22bb380c2a
Instruction Fuzzy Hash: 5001A7B5A81118A7CB04FB90DA52EFF77ACAB95340F140019E88667381EA249E09C7B1

Function 00981C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

Part of subcall function 00983CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00983CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00981CC8

Strings

ListBox, xrefs: 00981C94
ComboBox, xrefs: 00981C69

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: f09505fb6c523475a39706560963d2891b3350714ef98f4fb995f1d9a7dd0a60
Instruction ID: b8293e6eceba04c12f74eed132edf793a81963676bb6d33323b6e1157ccd4723
Opcode Fuzzy Hash: f09505fb6c523475a39706560963d2891b3350714ef98f4fb995f1d9a7dd0a60
Instruction Fuzzy Hash: AF01D6B5A80118A7CB04FBA1DA11FFE73ACAB51340F140015B88673381EA609F09C7B1

Function 00981D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00929CB3: _wcslen.LIBCMT ref: 00929CBD

Part of subcall function 00983CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00983CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00981DD3

Strings

ListBox, xrefs: 00981DA0
ComboBox, xrefs: 00981D75

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 1eaa2979130b003aef5e27b14fb6ac5591d8f9ed6991c334912b6f6322d8b2be
Instruction ID: d6419b11863ab62c2f5573ddfc2dd9ec84f931893bc26bd16a73cae4828aad02
Opcode Fuzzy Hash: 1eaa2979130b003aef5e27b14fb6ac5591d8f9ed6991c334912b6f6322d8b2be
Instruction Fuzzy Hash: A2F0C871B51228A7DB04F7A4DD52FFF777CAB85754F080915F862633C5DA60590983A0

Function 009A747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009A7493
_wcslen.LIBCMT ref: 009A74B9

Strings

3, 3, 16, 1, xrefs: 009A7483

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 05466828db9f1cfbc7d1d66a382416c1a9c89c9c07351f2f6925fc4bc075d2be
Instruction ID: 8340c65eb3bb3858875fd319551b8d34bcc9c862e166f042d523650ea9161f89
Opcode Fuzzy Hash: 05466828db9f1cfbc7d1d66a382416c1a9c89c9c07351f2f6925fc4bc075d2be
Instruction Fuzzy Hash: A1E0931561526010923112B69CC6F7FD7CEDFCE7907141417F545C5176DE548D9253E1

Function 00980B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00980B23

Strings

AutoIt, xrefs: 00980B17
Error allocating memory., xrefs: 00980B1C

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 15529d32e95bb6de2e322c6a53f857e1cda28bfd3ea203b880a0a299b23d8006
Instruction ID: be9548afed4d51d926c62cb832b18aea5110c708821bc9dc0cdaba23d138a97a
Opcode Fuzzy Hash: 15529d32e95bb6de2e322c6a53f857e1cda28bfd3ea203b880a0a299b23d8006
Instruction Fuzzy Hash: ECE0D83224431827D22436947D03FC97A888F85F24F100426FB98555C38AE1245006A9

Function 00940D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0093F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00940D71,?,?,?,0092100A), ref: 0093F7CE

IsDebuggerPresent.KERNEL32(?,?,?,0092100A), ref: 00940D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0092100A), ref: 00940D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00940D7F

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 1f9910343eb0038afa5c3c6141bd3d5c81bc243fc6a7db8cefe6924fa1550ed2
Instruction ID: 4ffb5fe68fa375ead33d3d33802606ca05ccca77b72a8ff8ca49b6e8149ff3a9
Opcode Fuzzy Hash: 1f9910343eb0038afa5c3c6141bd3d5c81bc243fc6a7db8cefe6924fa1550ed2
Instruction Fuzzy Hash: 3AE092B46003118BD7309FBCE904B567BE4AF84754F004A2DE592C6695EBB5E448CBA1

Function 00993017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0099302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00993044

Strings

aut, xrefs: 00993038

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 09d466bca0663115151383a8314919af55e128f80b0c51acc313f3b775f82baf
Instruction ID: eab04defebb0b89ac9f1e470893d73481f695605487bbbf20eac87f7d105f606
Opcode Fuzzy Hash: 09d466bca0663115151383a8314919af55e128f80b0c51acc313f3b775f82baf
Instruction Fuzzy Hash: 8ED05EB290032877DA20A7A5AD0EFCB3A6CDB04760F4002A1B765E2095DAB0D984CBE0

Function 0097D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0097D220

Strings

%.3d, xrefs: 0097D22B
X64, xrefs: 0097D2A8

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: e589c00c92159a97390b8eae73c9decc8591c41bc70ee4c6fff18ea96c46ab18
Instruction ID: f4b334c75ae0e7a0c01ad506063651dc9ec1249d40e63d8c9f7925d04553a39a
Opcode Fuzzy Hash: e589c00c92159a97390b8eae73c9decc8591c41bc70ee4c6fff18ea96c46ab18
Instruction Fuzzy Hash: AFD012A2C0A108EACF9096D0DC469B9B37CAF48301F50C852F92EA1041D62CD909AB61

Function 009B2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 009B232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 009B233F

Part of subcall function 0098E97B: Sleep.KERNELBASE ref: 0098E9F3

Strings

Shell_TrayWnd, xrefs: 009B2325

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 599643ed83526857640809eabb9c2be2dd4ca0f0e1580e9fae96889e1a49eaf1
Instruction ID: 5281c2334866b2c4e8f3477a319fc2c46a4f5d9a82aa17cdf63b4a7e9a6a3def
Opcode Fuzzy Hash: 599643ed83526857640809eabb9c2be2dd4ca0f0e1580e9fae96889e1a49eaf1
Instruction Fuzzy Hash: 1FD022723E8300B7E374B730DC0FFD67A049B40B20F000A06B386AA1D0C8F0A800CB04

Function 009B2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 009B236C
PostMessageW.USER32(00000000), ref: 009B2373

Part of subcall function 0098E97B: Sleep.KERNELBASE ref: 0098E9F3

Strings

Shell_TrayWnd, xrefs: 009B2365

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 5e9b639e03810aac244eebef7f8522193b12cac3b33815ea0622f7f1b0c1dc5d
Instruction ID: f6dd80587bf6d5c5117309ccec4c369ee59c12bc929b42d1b0965e5d421d352c
Opcode Fuzzy Hash: 5e9b639e03810aac244eebef7f8522193b12cac3b33815ea0622f7f1b0c1dc5d
Instruction Fuzzy Hash: 4DD0A9723D8300BAE264B7309C0FFC666049B44B20F000A06B282AA1D0C8E0A8008A08

Function 0095BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0095BE93
GetLastError.KERNEL32 ref: 0095BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0095BEFC

Memory Dump Source

Source File: 00000000.00000002.2908340836.0000000000921000.00000020.00000001.01000000.00000003.sdmp, Offset: 00920000, based on PE: true

Associated: 00000000.00000002.2908312910.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908423913.00000000009E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908481658.00000000009EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2908503801.00000000009F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_920000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 7be110426b4a3414fe63a94e0bb267d5c943caf47174927e3e358e11c22263f0
Instruction ID: 2fb01a5a206399f9d8104e682b85c14b30706aae5d35187c9ac30be9cf64306a
Opcode Fuzzy Hash: 7be110426b4a3414fe63a94e0bb267d5c943caf47174927e3e358e11c22263f0
Instruction Fuzzy Hash: 46412834604206AFCF21DF66DC55BBABBA8EF41322F144169FD59AB1E1DB308C08DB60

Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 23.219.161.132 23.219.161.132

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1726028533&P2=404&P3=2&P4=S22lvR2Xt81caCzPyKL1CzQJCzB2SUQje%2fS8M4QZsdmOKAXncuI8wmK92NEf4EYO%2fe4O71UyionoHoxAP6joLw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: gUXH1VAsEDKDcJLyF+DP9kSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.228
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.238
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\13267552-4655-4fa2-b255-e8c1b031e1c7.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5c888c91-8874-4e70-9dc9-c5449467658f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\5f8c746e-773f-49a2-b285-9076b61ded78.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\74c31f26-8aa4-4492-8487-0569d8f9d9a6.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8651fd1c-da57-4edc-a3ef-905988f8ef77.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8c965218-6e40-4ea5-88bc-91b3e1efb24f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\ee787fe1-f438-4cb3-93b7-e46c84fce134.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D7E062-1E48.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D7E062-1F4C.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0f0ef307-9fbb-4827-80c2-e4603f905e3f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\32a31a0b-2fcb-468f-94db-aa09a7fac9b5.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3499926b-bfe8-4d90-9242-3ca38296ab35.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\41adcc63-55bd-43f3-b586-ec20864bcdc0.tmp

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre