Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1505575
MD5:	4e47b9e5520b1a3bd0c8f59ff741bef9
SHA1:	a0d0fb46dac91c6ac783fe35a6cd5c44f0d10265
SHA256:	7662d44473b4c370596a961a962dc7327f6acf03eb69d9cbcda361ffd159742d
Tags:	exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7532 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4E47B9E5520B1A3BD0C8F59FF741BEF9)

msedge.exe (PID: 7548 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7828 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2084,i,10117366707530549767,18319138764020029181,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7848 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8184 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=2632,i,13622407252591464320,6831899295941176211,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9068 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7300 --field-trial-handle=2632,i,13622407252591464320,6831899295941176211,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9080 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7092 --field-trial-handle=2632,i,13622407252591464320,6831899295941176211,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7760 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1096 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2232,i,13285841369561515473,16385320068562832871,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4944 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4220 --field-trial-handle=2232,i,13285841369561515473,16385320068562832871,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2168 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2508 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2024,i,5048425808482636078,123280307142444447,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8772 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3264 --field-trial-handle=2024,i,5048425808482636078,123280307142444447,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 2342Content-Type: text/htmlDate: Fri, 06 Sep 2024 12:20:01 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.09ac2d17.1725625201.832e251Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: *Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin: *

Source: file.exe, 00000000.00000002.2589764731.000000000194F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2589764731.0000000001920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.6.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.6.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.6.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.5.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.5.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Web Data.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.6.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.6.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.6.dr	String found in binary or memory: https://msn.com
Source: Web Data.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Top Sites.5.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.5.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.9:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.9:49748 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C3EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00C3EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C3ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00C3ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_00C3EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C2AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00C2AA57

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C59576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00C59576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1324976334.0000000000C82000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_eb09ab91-b
Source: file.exe, 00000000.00000000.1324976334.0000000000C82000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_bb566588-1
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_18b348f8-7
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_19530fda-1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C2D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00C2D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C21201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00C21201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C2E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00C2E8F6

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C32046	0_2_00C32046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC8060	0_2_00BC8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C28298	0_2_00C28298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BFE4FF	0_2_00BFE4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF676B	0_2_00BF676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C54873	0_2_00C54873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BECAA0	0_2_00BECAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCCAF0	0_2_00BCCAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BDCC39	0_2_00BDCC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF6DD9	0_2_00BF6DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC91C0	0_2_00BC91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BDB119	0_2_00BDB119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE1394	0_2_00BE1394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE1706	0_2_00BE1706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE781B	0_2_00BE781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE19B0	0_2_00BE19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC7920	0_2_00BC7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BD997D	0_2_00BD997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE7A4A	0_2_00BE7A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE7CA7	0_2_00BE7CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE1C77	0_2_00BE1C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF9EEE	0_2_00BF9EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4BE44	0_2_00C4BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE1F32	0_2_00BE1F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00BDF9F2 appears 40 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00BE0A30 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00BE4963 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00BC9CB3 appears 31 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.evad.winEXE@71/297@14/11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C337B5 GetLastError,FormatMessageW,

0_2_00C337B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C210BF AdjustTokenPrivileges,CloseHandle,		0_2_00C210BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C216C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00C216C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C351CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00C351CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C4A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00C4A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C3648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00C3648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00BC42A2

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\cd7be301-bd50-4e5e-87dc-8274ed64ca26.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.5.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2084,i,10117366707530549767,18319138764020029181,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=2632,i,13622407252591464320,6831899295941176211,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7300 --field-trial-handle=2632,i,13622407252591464320,6831899295941176211,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7092 --field-trial-handle=2632,i,13622407252591464320,6831899295941176211,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2232,i,13285841369561515473,16385320068562832871,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4220 --field-trial-handle=2232,i,13285841369561515473,16385320068562832871,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2024,i,5048425808482636078,123280307142444447,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3264 --field-trial-handle=2024,i,5048425808482636078,123280307142444447,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2084,i,10117366707530549767,18319138764020029181,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=2632,i,13622407252591464320,6831899295941176211,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7300 --field-trial-handle=2632,i,13622407252591464320,6831899295941176211,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7092 --field-trial-handle=2632,i,13622407252591464320,6831899295941176211,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2232,i,13285841369561515473,16385320068562832871,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4220 --field-trial-handle=2232,i,13285841369561515473,16385320068562832871,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2024,i,5048425808482636078,123280307142444447,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3264 --field-trial-handle=2024,i,5048425808482636078,123280307142444447,262144 /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00BC42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BE0A76 push ecx; ret

0_2_00BE0A89

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_1B0169F09ADDF7CD2F276B4A034C51C4			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_1B0169F09ADDF7CD2F276B4A034C51C4			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BDF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00BDF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C51C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00C51C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-96106

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6817

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.5 %

Source: C:\Users\user\Desktop\file.exe TID: 7536

Thread sleep time: -68170s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6817 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00C2DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BFC2A2 FindFirstFileExW,	0_2_00BFC2A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C368EE FindFirstFileW,FindClose,	0_2_00C368EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00C3698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00C2D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00C2D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C39642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00C39642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00C3979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C39B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00C39B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C35C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00C35C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00BC42DE

Source: Web Data.14.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: Web Data.14.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: Web Data.14.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: Web Data.14.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: Web Data.14.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: Web Data.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: Web Data.14.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: Web Data.14.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: Web Data.14.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: Web Data.14.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: Web Data.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: Web Data.14.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: Web Data.14.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: Web Data.14.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: Web Data.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: Web Data.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: Web Data.14.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: Web Data.14.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: Web Data.14.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: Web Data.14.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: Web Data.14.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: Web Data.14.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: Web Data.14.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: Web Data.14.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-96202

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C3EAA2 BlockInput,

0_2_00C3EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BF2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00BF2622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00BC42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BE4CE8 mov eax, dword ptr fs:[00000030h]

0_2_00BE4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C20B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00C20B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BF2622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BE083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE09D5 SetUnhandledExceptionFilter,	0_2_00BE09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BE0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00BE0C21

Source: C:\Users\user\Desktop\file.exe

0_2_00C21201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C02BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00C02BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C2B226 SendInput,keybd_event,

0_2_00C2B226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C422DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00C422DA

Source: C:\Users\user\Desktop\file.exe

0_2_00C20B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C21663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00C21663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BE0698 cpuid

0_2_00BE0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C38195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00C38195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C1D27A GetUserNameW,

0_2_00C1D27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BFB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_00BFB952

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00BC42DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C41204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00C41204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C41806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00C41806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Process Injection	1 Masquerading	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://www.office.com/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://www.office.com/Office	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://msn.com	0%	Avira URL Cloud	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	Avira URL Cloud	safe
https://chrome.cloudflare-dns.com/dns-query	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
svc.ms-acdc-teams.office.com	52.123.243.83	true	false	unknown
chrome.cloudflare-dns.com	162.159.61.3	true	false	unknown
play.google.com	216.58.206.78	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://chrome.cloudflare-dns.com/dns-query	false	Avira URL Cloud: safe	unknown
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Top Sites.5.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	Web Data.5.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.5.dr	false	Avira URL Cloud: safe	unknown
https://www.office.com/Office	Top Sites.5.dr	false	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.6.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.5.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.5.dr	false	Avira URL Cloud: safe	unknown
https://msn.com	data_10.6.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.5.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.5.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.206.78	play.google.com	United States	15169	GOOGLEUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.81.228	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.251.41.14	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.200.0.9	unknown	United States	20940	AKAMAI-ASN1EU	false
52.123.243.83	svc.ms-acdc-teams.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.163.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.9

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1505575
Start date and time:	2024-09-06 14:17:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@71/297@14/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 42 Number of non-executed functions: 327
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 74.125.206.84, 13.107.21.239, 204.79.197.239, 13.107.6.158, 2.19.126.152, 2.19.126.145, 142.250.186.131, 142.250.184.195, 92.123.104.42, 92.123.104.43, 92.123.104.34, 92.123.104.36, 92.123.104.41, 92.123.104.40, 92.123.104.35, 92.123.104.38, 92.123.104.37, 23.96.180.189, 192.229.221.95, 142.250.80.35, 142.251.35.163, 142.250.65.195
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, iris-de-prod-azsc-v2-ncus.northcentralus.cloudapp.azure.com, b-0005.b-msedge.net, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, l-0007.config.skype.com, edgeassetservice.azureedge.net, azureedge-t-prod.trafficmanager.net, business.bing.com, dual-a-0036.a-msedge.net, mira.config.skype.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:18:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_1B0169F09ADDF7CD2F276B4A034C51C4 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
13:18:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_1B0169F09ADDF7CD2F276B4A034C51C4 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	709827261526152615.exe	Get hash	malicious	FormBook	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
239.255.255.250	https://rznfilarmonia.ru/bitrix/redirect.php?event1&event2&event3&goto=https://agroserviceica.com/rkos/dist	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://hijauanhills.com.my/wp-content/upgrade/index.php?uid=qvc-communication@qvcjp.com	Get hash	malicious	Unknown	Browse
	https://zoomzle.com	Get hash	malicious	Unknown	Browse
	http://jan47nfhc.3utilities.com/#a7oOTE-SUREJACKam9obi50aGlncGluQGNoZXJva2VlYnJpY2suY29t	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://emyoo.com.au/wp-includes/Text/Diff/Renderer/	Get hash	malicious	HTMLPhisher	Browse
	https://clarity-financial.com.au/wp-includes/widgets/	Get hash	malicious	Unknown	Browse
	https://hye.com.mx/	Get hash	malicious	Unknown	Browse
	Remittance Advice.eml	Get hash	malicious	ReCaptcha Phish	Browse
23.200.0.9	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
13.107.246.60	https://protect-us.mimecast.com/s/wFHoCqxrAnt7V914iZaD1v	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
13.107.246.60	http://wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5	Get hash	malicious	Unknown	Browse	wellsfargo.dealogic.com/clientportal/Conferences/Registration/Form/368?menuItemId=5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
svc.ms-acdc-teams.office.com	Inspection Notice.msg	Get hash	malicious	HTMLPhisher	Browse	52.123.243.74
	file.exe	Get hash	malicious	Unknown	Browse	52.123.243.199
	Order_ 039924.docx.doc	Get hash	malicious	Unknown	Browse	52.123.243.78
	z42ordemdecomprapdf.exe	Get hash	malicious	FormBook	Browse	52.123.243.200
	Firstontario Caller VM_00_94 Seconds REF#e764f827cc206df3733c6c719eb86bc36b5f54d1 7_9_2024	Get hash	malicious	Unknown	Browse	52.123.243.81
	11fa2b48-c25d-d2a8-7e3d-327f8f3a8ace.eml	Get hash	malicious	Unknown	Browse	52.123.243.199
	Updated Handbook.docx	Get hash	malicious	Unknown	Browse	52.123.243.83
	Colruyt Group - Contact Information Form.docx	Get hash	malicious	Unknown	Browse	52.123.243.70
	[SUSPICIOUS ATTACHMENT] Fwd_ Status Update_ Download Statement.eml	Get hash	malicious	AsyncRAT	Browse	52.123.243.221
	Ewhite Replay VM .docx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	52.123.243.77
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	709827261526152615.exe	Get hash	malicious	FormBook	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
s-part-0032.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	All-in-one Calculation Tool.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://emails.microsoft.com/dc/e_4JGRIDqcoiTU1HR-giCWWkyCmeORqUCO4pEjpDTddrBVlbCteZJj8QfhFvhzGnrSwkFwZUI8U0ElApY3ruN2moaZlprSDGWrxtrbI1MBxlzIbpGFmlWRXVz-DfjyzMo6DjGJvk2NdT1NgnbRCGzTYRw7PzgS1STErkGqov-2A=/MTU3LUdRRS0zODIAAAGVXrvPPFFO4qk2k5S0WBN6iOmgYzwr15ol9HTLY_vuNwgIljWNKTe4HuyrKAtA0lJBatyTgWI=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://emails.microsoft.com/dc/zSgS2A6q0riGfHtfc6vB4o2EDiQ6lN3O6qiMomONyUJ0HsQ2sZIsMh689GSSYbTLO3mCkWaodie4MAOslvNCWW_9a3plE0P-Ez0LQY78TZmDPHuwNSWhLFzTYMtoZfimsqDGDjfg-w-v-HUlOmaZvGFLFwxVF_4UkVJu8KOKwPs=/MTU3LUdRRS0zODIAAAGVXXQTXko_YJBSIbQm_RlsGLlFgr2A-kJcbF9EmGwaO1zI2Do4ydFFpnBfqgMZYQyQQ3e8Go8=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://dropboxlink.net/082f8223cc1f98d8?l=60	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://buysuhagra.shop/ePFcjxsx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://1drv.ms/o/s!Ajq9zC5M8q4HgQZYMFwoYdIgQ7Uc?e=V7cJrH	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	gold.exe	Get hash	malicious	RedLine	Browse	20.52.165.210
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	Remittance Advice.eml	Get hash	malicious	ReCaptcha Phish	Browse	20.189.173.27
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	file.exe	Get hash	malicious	Unknown	Browse	13.107.253.72
CLOUDFLARENETUS	newvideozones.click.ps1	Get hash	malicious	LummaC	Browse	104.21.82.93
	COD 09256214__et__t_, _____st__ 2024_765124.PDF.exe	Get hash	malicious	Azorult, PureLog Stealer	Browse	188.114.96.3
	human-verification5.b-cdn.net.ps1	Get hash	malicious	Unknown	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.158.147
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.158.147
	Full-Setup.exe	Get hash	malicious	LummaC	Browse	104.21.10.172
	SetupFile.exe	Get hash	malicious	LummaC, MicroClip	Browse	188.114.96.3
	YzvChS4FPi.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	NEOM_SUPPLIER_EOI&QUESTIONNAIR_FORM_SHEET.PDF.EXE	Get hash	malicious	AgentTesla, RedLine	Browse	104.26.13.205
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	gold.exe	Get hash	malicious	RedLine	Browse	20.52.165.210
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	Remittance Advice.eml	Get hash	malicious	ReCaptcha Phish	Browse	20.189.173.27
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	52.101.11.0
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	52.101.8.49
	file.exe	Get hash	malicious	Unknown	Browse	13.107.253.72
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Unknown	Browse	23.219.82.73
	NEOM_SUPPLIER_EOI&QUESTIONNAIR_FORM_SHEET.PDF.EXE	Get hash	malicious	AgentTesla, RedLine	Browse	172.234.222.138
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.31
	pud8g3zixE.exe	Get hash	malicious	Amadey, Stealc	Browse	23.44.201.4
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.36
	file.exe	Get hash	malicious	Unknown	Browse	23.219.161.132
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.16
	file.exe	Get hash	malicious	Unknown	Browse	23.44.201.27
	file.exe	Get hash	malicious	Unknown	Browse	23.44.133.38

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://rznfilarmonia.ru/bitrix/redirect.php?event1&event2&event3&goto=https://agroserviceica.com/rkos/dist	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://hijauanhills.com.my/wp-content/upgrade/index.php?uid=qvc-communication@qvcjp.com	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	http://jan47nfhc.3utilities.com/#a7oOTE-SUREJACKam9obi50aGlncGluQGNoZXJva2VlYnJpY2suY29t	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://emyoo.com.au/wp-includes/Text/Diff/Renderer/	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 184.28.90.27
	https://clarity-financial.com.au/wp-includes/widgets/	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	https://hye.com.mx/	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27
	http://hikmaa.com/	Get hash	malicious	Unknown	Browse	13.85.23.86 184.28.90.27

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24104
Entropy (8bit):	6.054074781686808
Encrypted:	false
SSDEEP:	384:RtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NGModUlqH+qdFVEQSGzx96YHovjqNgnZV:LMGQ7FCYXGIgtDAWtJ4npUlqgQFzx9fK
MD5:	F19FD9213BD8E9B586406A6695A850EC
SHA1:	4838F20BAE9B12FDA1D1B2E08219E437E4A2FFC3
SHA-256:	0D340E9BF6AABFAFCA7A15A773F7DD5E3EBEA4D167F617BB5E202BBDC2158D6C
SHA-512:	66FD1A8092981794373E4FC05E530FF588F73A1588D765588C6B42200567E6153B06BE58220E7E60F7FC76FC7AD8D6ACCE15D2E3E331C4AFBC792E0727E3A6B2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411jYlhlRsBQRm+LIWvOaiW4hdcyEra5fCtzINfylY7VRB4y

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\38c58245-28cf-46eb-845b-7de554eb5d4d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5607307501957655
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtw59850MnBLlGtOoHyikJsJdXmuBuwB9Waid93Nhkzk3XDQQRZ:YuBqDPaf+9853BLktv2KRBzBAJdBkzG9
MD5:	1C7F6A8757668331D5DE93D64835FC7A
SHA1:	9D8EAA2AE496060C5FA50DEF6C0F12CE821472B5
SHA-256:	7BF2C4BC2FA353E3F3CAC570EF75A2292D0479F4FB463550A11B8BC6A8507458
SHA-512:	95881F89CBF2A359196E827552EFFCC03DF2B0B2AD5884B27B44F9993D4A4259A96BFF805C45A06BB051AF62298C50715D1CCC9048A13A1D4F434BEF47274634
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370098675948580","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725625075"},"user_experien

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\40033a9e-66fc-4481-8397-96994df845b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70153
Entropy (8bit):	6.0725435120599265
Encrypted:	false
SSDEEP:	1536:LMGQ5XMBG5tp6pE2LNUqJfNW0MhiO/nQFzrILna6:LMrJM8jpG5JWr/QFzrILf
MD5:	66CF0BD364957763492A940F22E17495
SHA1:	13BB1524FF7893E668A6B00FCD6A896DCD3A3BBC
SHA-256:	7CBFFC4D68F3F73F60DD25D0CDC1ECE657ED07EB668D25D5521BC535FF1FC4B7
SHA-512:	DFAFAE8420604E637065246D5AC486A0DE351114150841E8C62689B1233B485F76580C877DC71C2C9BD96107BE2A557A93B9C07CCF7789CC682106B158241070
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411jYlhlRsBQRm+LIWvOaiW4hdcyEra5fCtzINfylY7VRB4y

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4dd47970-913f-458d-a8fa-247035345a16.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4236
Entropy (8bit):	5.499866976726739
Encrypted:	false
SSDEEP:	96:0q8NkGS1f+O5xLktb58rh/cI9URoDotoQ8yBqpvCJd4pnJkJcNSDS4S4SDSEI4a:/8NBS4OPYtseoDUDFypJkJJ
MD5:	0E691807F1D8BD96068CADE8F7C75395
SHA1:	0682ADDC8892E73A7903A536BA30C58BD8E75578
SHA-256:	E9A6A76DE43826C86C5950598D4247A6702D7E0A489CC9F2CA9B6FD6D8D94BE7
SHA-512:	E7C13211EABA9F86EC5BEEE44319209AC143390208E69D349CB470910F7F2C003BCADCB72027F7112DC800221EB52FCB97863759855D4E391528C612A547F0EA
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\59fe68bc-9b4c-4739-9282-1bc6515f08f9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20784
Entropy (8bit):	6.064701593378712
Encrypted:	false
SSDEEP:	384:RtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSMndq4aJPNgnZODbSv:LMGQ7FCYXGIgtDAWtJ4niq4aJVQa6
MD5:	7DE55086FAD2970F95AFAFDCE263DD48
SHA1:	BB59AADC8092E2640795DC064C227045BB0B380A
SHA-256:	43856AE6E60ADB661B415F7FC0AAD72B039FA2343BF1755D5969F9197FE1BAC0
SHA-512:	F895DB432F9EBC6A172593751053184FCDDBBE7B430D0079606C93024CCE6F35B8B7F43455B94A77F8507A4A7A548484422DB0D79D9254EF84E38ED256DFF87C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411jYlhlRsBQRm+LIWvOaiW4hdcyEra5fCtzINfylY7VRB4y

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\873917dd-c33b-4aae-9768-c89f419db94f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2959
Entropy (8bit):	5.589943132273723
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0af+9853BLktb2KNHB+TtdrxbvBAJdekvR4ysaJkX5cwYwlRvp:Xq8NkC1f+O5xLktb2MBqpvCJd74yVJkl
MD5:	0D6EA45D52D9AD979DB4EFA8CFD5A358
SHA1:	02A8AEA85C547586EB4E74713851258279E66E80
SHA-256:	E9A67E2CB85CA76BD5E9B19C048AA9036B5CF2318EF019E8CD83FE0F3FC72340
SHA-512:	B240957E2C27504EBB7C4AE48EF736CBC16CBE9E24FB3A622468FA95FA3CA6EBA04C61833916A97DF915B30181C88512276FD43A871F28E6A182A56B0B271DF0
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"policy":{"last_statistics_update":"13370098675975583"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\93b9398b-ac87-4f40-8456-f92795dd8e7d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3336
Entropy (8bit):	5.6150567342383715
Encrypted:	false
SSDEEP:	96:0q8NkC1f+O5xLktb256BqpvCJd4pnJkJcNSDS4S4SDSEI4a:/8Nb4OPYtXFypJkJJ
MD5:	40C2B6C7175008156D5D59B2EF2FA64C
SHA1:	2D84B2F50DE5DDBD83D25C82FBE03A163E83C96A
SHA-256:	289D80D2DF6DAADAAD34BC123224309D5358ED204F4051BE5BEE69F8D68AE8CC
SHA-512:	983A23D7A5318CF01CFD374B3A2A6FBB8BA3E3032C4E81291A5C3098154A8ABBCF28E4A71054BCD64B098AC0F806B72CE4876BFB0D99316338F29103B455B7CD
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\e986142e-875a-4b7c-9764-a6b057fa0957.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66DAF2F3-1D7C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.040500706296869075
Encrypted:	false
SSDEEP:	192:gWUjLYiVWK+ggCdlCJtD+FX9XuokgV8vYhafvNEfbcRQM97NNn8y08Tcm2RGOdB:tUjjl+qvnhIuQtNN08T2RGOD
MD5:	91172E21C03EDBD0A3C31FACC387D676
SHA1:	490DA8A96175C75D39841B2ABAB32C575DCAD1E8
SHA-256:	5235D4E72E3B79EA74A1F8FE74EC35C7DB27A222D7AF8D611FFB85CDD0EFA0DD
SHA-512:	FFFAB7FC8A93F39F103CBA9BB25AD2FC9B92AFF7A3DACA1F6912FF89B00D217B93E5A8598D074B882ED5B0CDF1823A5745C30A70965C7D2284043151557EBEBA
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".gxnhgb20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@.............2..................+..$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...."..~.G@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66DAF2F4-1EA8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4517517771568008
Encrypted:	false
SSDEEP:	3072:EZr3DNPOtXluOMLEu1hd4V/HKdwTonzek7/fnnUC8u+TK6tg1HFMLz6LIjXWbtRk:4hrdlEK6taHmGnql6aHesXfX
MD5:	27528DDB780DB60E44A8D40C30DE8701
SHA1:	3C12C8AA145D86355AFF40B7254F7E6270E52DDA
SHA-256:	F86D7D666E24C682FCD4EEB419F2BB287C51F8CF1DD8E674AE0D0841675ADA2F
SHA-512:	44804400ECC317AFAC2CF60EBF1CDA650A77A313A377FD60BBBE01077358F10CDDB765353B8E0C81922A41FCD71E14D2CFDA1783D3B9C75E63BA88815E77DB77
Malicious:	false
Preview:	...@..@...@.....C.].....@................?..X?..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?.......".gxnhgb20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.138032036069489
Encrypted:	false
SSDEEP:	3:FiWWltl6weoYFOe1e4HSRqOFhJXI2EyBl+BVP/Sh/JzvDCpEmDxEUEtXl:o16wezw4yRqsx+BVsJDehdEUEt1
MD5:	B28C5469C8C4965BE9EE112F0FFE87E3
SHA1:	E33FE5BAACFA728FEC62EA245A0031CBBEF161CD
SHA-256:	BA9792ECEA6C2D517E90820FD62412D77BBBC55B923415D5C37D2676CC187623
SHA-512:	67DA8DD7D504A45DE7B8A7C608DFB4004B7DDAE818ED6CEFC927556FD2073CA259A10766D9715654EFC235B145371602AA4F7C8D725C771B2BFE35E6A5945920
Malicious:	false
Preview:	sdPC..................../,...=kO..-]G.."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................4b20cc9a-074a-4b5f-8c39-8f9fe38a1a90............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\59948aaa-95fd-45b0-9bbd-a07c2ca6179c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6524
Entropy (8bit):	4.975436318848336
Encrypted:	false
SSDEEP:	96:stBqfdis1Ab9wXFN8zfs85eh6Cb7/x+6MhmuecmAeYOpQG2MO/EJ:stB1sjFNkfs88bV+FiAmLPOMJ
MD5:	5D13E1E0868758EEEABD4AEA5C9B30C5
SHA1:	09BDBCFEF8F4DD730027CD59828DDC76ED9B1763
SHA-256:	6CDB25CAB9A4B13F8F7F59B95843496DB9BA6168D72372C2F7CBEA4D58119FB8
SHA-512:	8A16FD8A1F650E8C1A1547F04ABCD11C63FF84844DD6FA63C4EBB043A6DC13ABA2CC683277AD4A5F89F1D66064CAB3E966B6D438CC90A820B00133128CD599FE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370098677265021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370098677264737"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\67b8302d-a5fd-4dc5-ac55-6fe9f14a705f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6422
Entropy (8bit):	4.973404194107876
Encrypted:	false
SSDEEP:	96:stBqfdis1Ab9wXFN8zfs85eh6Cb7/x+6MhmuecmAeYO6QG2MO/EJ:stB1sjFNkfs88bV+FiAmePOMJ
MD5:	8C3B5921BDFE22BA2FEF1A912A808769
SHA1:	915B359FC398D56A2F82B5ED36627B6138D78E21
SHA-256:	D6627E9CFDCAD0AB0DA0C3249D0FFB60B4DB5371F3CD3F167527D338209E49FE
SHA-512:	4CD866F41489B84A0F97247D31263003730B4E198A12DAAC77D2D0D0217076539537B10EBA2DC6F62FBF2E46A9C510A40632910EE569DB4EF8F1B488E03D4C3D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370098677265021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370098677264737"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7e87ef44-626b-4303-a442-4d37e1beaa20.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\96ab2a52-1cf2-4953-87f3-daa6064c1e6f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566393873619938
Encrypted:	false
SSDEEP:	768:tuXF4TWPu0fYP8F1+UoAYDCx9Tuqh0VfUC9xbog/OViTeXyrwTpGtuJ:tuXF4TWPu0fYPu1janKX3kta
MD5:	E1D5FA2843E9899D43E18D2E30522800
SHA1:	6AA9C53EDA4119D6A17DA48E018EF7ACEE73BED2
SHA-256:	236EAB7FC8CA74644E4A4C0DA9BFE583DFCEC1FD00CF63D11F0C6A53994EB46A
SHA-512:	D7DB6CAA654A61612A7D68B59276D034E46286F5457F14720A113EEA8F63E1D7DC03679FDC4C50C4EAC97AC02D842D666C568448051BBC492B67A8AEFCA631CE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370098676661773","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370098676661773","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\9d3920b3-0aaa-405f-b289-6cb4a43c6b0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.321173564862458
Encrypted:	false
SSDEEP:	192:dAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:GOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	0275154466BC8E04C98FC0963CA95E32
SHA1:	9555B86281539835B2188BF7044C2284127C5084
SHA-256:	2302AB74D234947D0B44C42AEE7D28D054AA21ACCA7C2C287F10D61A1EFE5278
SHA-512:	CF537158C5809F3168E76B52F6C99098236F13A5F3EC50D359355214016CD18ADA79C41C65ED2FF670D2D2B6F4E58AC669557B137A7A7C727342E6209192C67D
Malicious:	false
Preview:	...m.................DB_VERSION.1.a.................QUERY_TIMESTAMP:arbitration_priority_list4...13370098682031273.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.0929735129914375
Encrypted:	false
SSDEEP:	6:PgUCq1qLTwi23oH+TcwtOEh1ZB2KLllgwA+q2PqLTwi23oH+TcwtOEh1tIFUv:PgPwZYebOEh1ZFLngCv8wZYebOEh16F2
MD5:	335991FE71C60F455ADA8208C775CB37
SHA1:	4B2E4AEACAEA5DAB2DCB4E924A5A43D8241BAC17
SHA-256:	FEF882D5DC90E49CCE86625511D976B9B8598517F9BFE037D960868609C1F655
SHA-512:	61F803B838056A73F9DACF1D2808A4725D3DDB7120CE062256DD63B05F190D672C87A451B725DD6ABEA8E917E9CA3E3631DE4D2C2F98839B5CA2B4132D03B8D2
Malicious:	false
Preview:	2024/09/06-08:18:00.887 23a8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/09/06-08:18:00.989 23a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.043921927952293556
Encrypted:	false
SSDEEP:	6:/Fii2iOikM/lawbafalfq+Hw2MtwAIYkllcNB8LH/lA:doEa9faxq+Q2ERIR/jJA
MD5:	F97E000443CFBDEFB5251189FD84D0D6
SHA1:	ADA19DCECB31672603D65E731288AE8A53C54FE1
SHA-256:	53B6ED6FFCD20F407BC51DC06FF3643C6A53F0C9306BFFF0B7E998ED0F288950
SHA-512:	81D7568DC218BAA7DA5E9122CEB71466DE013622BE1534FA292314060E6F7F265E833F9D6C23582ADB5C56FA6B85BFD61937C5AD251DE0C3E654B8EAA2FF31A0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0956836589024963
Encrypted:	false
SSDEEP:	48:MV4XesNxV4A3es3NUeGj/Af5ecT3lWp4:MV4X3PV4A333NLGzAxT3L
MD5:	0FA4D18C52738BC4A3580DC71BD8ECF7
SHA1:	3E5B198FC8160F4CA67B4BC0D24CA8B250993459
SHA-256:	C9F1EEA660ED660E9AEE725515108C28AEF25205F674FB7F392C527A2AD201EE
SHA-512:	9DAB7B31A3A4468D5E2694D6409AF4E492BA9AB9014AEF6331F7ABA5A86B85871C7F0081E7F1A3DFD519CAA762CF0B020996ECD49EAA9B9AC197E63D24D75A37
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.2831964762545996
Encrypted:	false
SSDEEP:	768:gmy1FpzJtBy1FpzJty1FcxJt81FcxJtH1F2wJt:gLbybwbpb+b2
MD5:	2F75F6664BA044F80FBEC9AF31ED06FA
SHA1:	A5C4005B3C6C934F7F69FF8BC633C05E0647F199
SHA-256:	16CD702426A7BEDB60E700AB3D21364FBD0EDE922BC3421B9A2EE72054432549
SHA-512:	8088EEECB854F62A7E7F4A1E4A4997DDFF7F717FF47CFEAAE4C9A43FF1BB0743DD6715697C2309340896DE889DC2A53F574EA7964A095D975E2F0A5DC5D32794
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:LsulAQl:Lsnw
MD5:	1E7AEDAEC01BA78FA6568FCAC65B53E9
SHA1:	FA300F0750BEA6CCB2EA557CF9317BB2523961C8
SHA-256:	921948098A2AD1AD1CDAA42EDD74299DB38E3DFAEB38D3CB8CF68CE6E5164220
SHA-512:	E04B03609ADBD6D3F4578E0F68BDC6332E6A315C9E3CDB6A2A5D75F3F6A4A951E77B7DA61116DAA41ECEDD73FB91C5704B8D7AFA4D53E468AE951896F66B9614
Malicious:	false
Preview:	.........................................YY.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:ehNX00E3alqn:ehC3alqn
MD5:	53DA938D834A4D6A932F66B431B945C9
SHA1:	1B4E18D2E548730B457597026373B3052AC16D31
SHA-256:	D9C44FCA216D73140AA17E907E29782BC664E02793FF45C7B500091FA1CA0A33
SHA-512:	8D1677C625113077761B69860B2F2BAA5AFD39C8AAEC75978592595873ADEE73B7E42D36581A76916E041013FCA278DE5FF0736A00399CF39714874A9419BCBC
Malicious:	false
Preview:	(......oy retne..........................@.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:ehNX00E3alqn:ehC3alqn
MD5:	53DA938D834A4D6A932F66B431B945C9
SHA1:	1B4E18D2E548730B457597026373B3052AC16D31
SHA-256:	D9C44FCA216D73140AA17E907E29782BC664E02793FF45C7B500091FA1CA0A33
SHA-512:	8D1677C625113077761B69860B2F2BAA5AFD39C8AAEC75978592595873ADEE73B7E42D36581A76916E041013FCA278DE5FF0736A00399CF39714874A9419BCBC
Malicious:	false
Preview:	(......oy retne..........................@.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:tdHTEuZkq:PgWkq
MD5:	7B6BFAF40998B130D07D8E6CD895DD11
SHA1:	12EF465F67B982738DE69A21DC1EA81AF14586E8
SHA-256:	00AE547CC22C5F008F1A5CA97F75F90BF48190B2CAB7570A20A9B712A904465A
SHA-512:	FDAC26DE159DD3B9967FE71164FD9B101216C2FA6235C3584837259D4878772F682953806A0030F1C6943A2F79356314808E63F6590D9ECE73DBCD7AECD7AA53
Malicious:	false
Preview:	(...p..oy retne.........................<A.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:tdHTEuZkq:PgWkq
MD5:	7B6BFAF40998B130D07D8E6CD895DD11
SHA1:	12EF465F67B982738DE69A21DC1EA81AF14586E8
SHA-256:	00AE547CC22C5F008F1A5CA97F75F90BF48190B2CAB7570A20A9B712A904465A
SHA-512:	FDAC26DE159DD3B9967FE71164FD9B101216C2FA6235C3584837259D4878772F682953806A0030F1C6943A2F79356314808E63F6590D9ECE73DBCD7AECD7AA53
Malicious:	false
Preview:	(...p..oy retne.........................<A.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlNEQ//l:Ls3mw
MD5:	8D3D8346D25C11D0C13E254C53E5CE4D
SHA1:	4C3FB24BF0D2E0055306B398E454499B4D5E482E
SHA-256:	1E7398AC1CC339FDD057354C316A6675418357E97930DC1EB260CD560555F65D
SHA-512:	782102694E1585AE79D01AA405D5F7FC006321FDC812FC6960F4C6B8E12F8018FBC89B373BB073876D8E8A4188A1A4D3C5994E10F38BA4833ADC5D69D8B34F29
Malicious:	false
Preview:	........................................k7K.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354162671932686
Encrypted:	false
SSDEEP:	6144:RA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:RFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	E4FD6424AD311873BD5491782A405097
SHA1:	31FE3686819699BAB0907B1D9E77885C58116AEB
SHA-256:	8233650C80C60D087ADB13DC6592A36C6CE00E3AE1590A632337402697E48E7B
SHA-512:	E2514A549E8ADA4C711A4FBCC0D751D4E2CD7FB73BD7B7C258AC623580EC0F03565202837F3A3813790454FD1896AF03BD6886D07A7248687E9108A8943E8B40
Malicious:	false
Preview:	...m.................DB_VERSION.1...q...............&QUERY_TIMESTAMP:domains_config_gz2...13370098681528439..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.16345644957843
Encrypted:	false
SSDEEP:	6:PgI1qLTwi23oH+Tcwtj2WwnvB2KLllgbL+q2PqLTwi23oH+Tcwtj2WwnvIFUv:PgxwZYebjxwnvFLngmv8wZYebjxwnQF2
MD5:	8E6976206B7AE29ABF599E20C4017097
SHA1:	7570A7A915BE70603CC8C0BCB36B48AA4ACD7EA5
SHA-256:	F89243E1F430ED181DB0F392FB0CA72F8172F365C2E1F433C65E8AA54AB69F02
SHA-512:	10A38B505383F9D39B0D07395E793D4B31E5D780065320D0971936FBF8C892E48B0A950CB216E1D1969563A4F40CDA1630F35377798BD3802F970D77C30F9DFE
Malicious:	false
Preview:	2024/09/06-08:18:00.801 2398 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/09/06-08:18:00.839 2398 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324619530843908
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RH:C1gAg1zfv/
MD5:	8BA2E550219F7DDE7D4DA5E629A1BFE0
SHA1:	5392D3B54E8F9C1FDB81E43329113D19E832E891
SHA-256:	7E90DA348582C6D6B56CEE050EE0D5F4B7255FB2E6AA9444CD064729421C2295
SHA-512:	1EAAE592A0468E2C6BFFA7ED4FAA3B5E44FC27B0370197FF01BD182ADACF1F82259C2D20552915A5D3E938F80869F94A6B1479A7508F8A725ABD1E79AD315666
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.214101878444179
Encrypted:	false
SSDEEP:	6:PpjJB1qLTwi23oH+TcwttaVdg2KLllpmM+q2PqLTwi23oH+TcwttaPrqIFUv:PvowZYebDLnYM+v8wZYeb83FUv
MD5:	1E53BE473FA699C185E3E733069BB943
SHA1:	DF24F5FFFEDE45716E7AD4278C3CFD07313041B9
SHA-256:	474985B5BEA1C1B10B78062E3CC6063C7B3C51254320B2BA6B6B627D5A7666B7
SHA-512:	0FA168B3F8753706D73378679918F0A4B043CA6388739A0FB6B344A4AC9BF31638D1CB0CA0867EE7C331E70766CF2A09279E8C15011278355C4063FEEB979959
Malicious:	false
Preview:	2024/09/06-08:17:56.731 1f6c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/09/06-08:17:57.093 1f6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.182268153178584
Encrypted:	false
SSDEEP:	6:PpGSFB1qLTwi23oH+Tcwtt6FB2KLllpkDKqM+q2PqLTwi23oH+Tcwtt65IFUv:PjowZYeb8FFLn2RM+v8wZYeb8WFUv
MD5:	FAA4AA4FBEC85D3B7077CEF282DFCED9
SHA1:	7E629540FE26FF205FCB422D326EBA3EDFBBFA1E
SHA-256:	53DE38FE71FF9337CFEAE601FE9D1C26FB5D79B8E5FE166CE3ED986996408173
SHA-512:	EDBB4EDA10F7A92E9DFE35A9B4FAE74515C42905E11F17A609ED507B89999527EA9B1D37402DEE1147BE24106C2F22CBE411F6E548E8A00F307B31ED68D09C71
Malicious:	false
Preview:	2024/09/06-08:17:57.095 1f6c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/09/06-08:17:57.141 1f6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.180636922829339
Encrypted:	false
SSDEEP:	6:PppdlEq1qLTwi23oH+TcwttYg2KLllpzdI+q2PqLTwi23oH+TcwttNIFUv:PvdefwZYebJLnBddv8wZYeb0FUv
MD5:	42C5CA657622D1FD6E264763198B8EA3
SHA1:	00B25526B71D80B46304701962CF9A87AA459CC8
SHA-256:	FDF0B5D82DD9366A7A55BFEEC7D042DDA6CA7FA813EC236335B456D4B508720D
SHA-512:	520DFC2A45806EC072FA1E805D51EE7E68DF23CBA5842E85D62FD0BDA8C3569F1F9EBE4452C0951FE631FB8B573B4493A7906C0DC8C2A8765A6698472BC47B3A
Malicious:	false
Preview:	2024/09/06-08:17:57.654 1f88 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/09/06-08:17:57.668 1f88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlQb+l/l:Ls3Qbe
MD5:	A870E8D61B174039BA5CC8DC6CCA2CF8
SHA1:	D6039C2ACDF7F42229C1C139F246D6776C3869DA
SHA-256:	87DF6B2341285A86605E146B4819A729526EC46DD577A3272210FD97F7CBC113
SHA-512:	D0F9F2A9BF19ADA1341D8719045713F9531F6751CDB66073DD35C910130EC6E22DB5974C1D3F79EA3909AD5F62957075E34A443A0B4A37AEAADD097A1FDB5215
Malicious:	false
Preview:	.........................................:I.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:3/RtFlljq7A/mhWJFuQ3yy7IOWUvtQdweytllrE9SFcTp4AGbNCV9RUIA:3/K75fOsd0Xi99pEY2
MD5:	0B42A67A4121634B43099E81EA2E7377
SHA1:	A3A81F74D47BF27711C2B51C65787B291E2F9ADA
SHA-256:	1E5356E0CF8A0FF52F7A84FC1D9A64360C21B7A9E76F008F9B3A46717EA998B2
SHA-512:	4C0742E8F2A3576A0E2B9FA01D2563D06DE0B12454C6C32B6AEE4956CB5E627E057CA93A8F602022BB50A8CDD87AE3F879A64E14B3E155880940A34B176C2665
Malicious:	false
Preview:	...............Z...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	375
Entropy (8bit):	5.253458158337323
Encrypted:	false
SSDEEP:	6:PpMFB1qLTwi23oH+TcwtRage8Y55HEZzXELIx2KLllpTRM+q2PqLTwi23oH+Tcw3:P+FowZYebRrcHEZrEkVLn3M+v8wZYebV
MD5:	6E57A18EFD525C91698FD7BEF3DFCD39
SHA1:	C4E827B384992939CC678C56888C9187A9CB1900
SHA-256:	97B9D20709E939C5512687199AE93B697D956D1625A6CF0DA6301B2AA719FD7A
SHA-512:	6480DABDA44125335B73330862DDEAC4E4AA44BCB680D1069531743D23A8E6DF39516B9CE66D4EA8D0C81A56D4468C5798A4083014E5F2E3FF76C0468D62B341
Malicious:	false
Preview:	2024/09/06-08:17:58.730 1f6c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/09/06-08:17:58.743 1f6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.225690824446787
Encrypted:	false
SSDEEP:	6:PprBuFB1qLTwi23oH+TcwtRa2jM8B2KLllpkdFN+q2PqLTwi23oH+TcwtRa2jMGh:PpBu2wZYebRjFLn7v8wZYebREFUv
MD5:	43923067799CC17F5938A6C98FC5E365
SHA1:	66AFCF07C0816C0F4CE49D6615D0A24E8772AA42
SHA-256:	B08AB7D6CD156D0F8677AFAB22D59FC7E314C7D11263650C172AA7413A22C82C
SHA-512:	414296FC3A362C8DB05D90B1B20611763967EF1AA8BBE0C4634FEAE28DDE219B42A213C301A5E5B1B93F802DA3CE9918C73976531090EC00DCC7DC91C7639BCD
Malicious:	false
Preview:	2024/09/06-08:17:57.445 19b8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/09/06-08:17:57.900 19b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\049bf1ff-2839-4077-864c-d381c62daa81.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\629be31c-92ed-42b3-9989-438d3950fdad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\81f8e650-d0a9-497d-b35f-9520701254a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF334cd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7608984928852763
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkSb:uIEumQv8m1ccnvS6p
MD5:	6ABDF643B72F06CA996C7D1F1684C493
SHA1:	95D0519ACC3877FD8F296D77ED7F19B1443E8132
SHA-256:	487114987419FBA548F61CF222BBD2B4374343C52E08F4AAAE34F75AA93F3E3C
SHA-512:	0A1E3467D2F7F6AB9052D340A3EA205696C9DBDF326676FDC7AAF2F0970B13D5F13024FCF508E55175543ECBEBBB8E310F3D67B1D0EE3467952FEB529F65EA3D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF21274.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\b6f804c7-da5e-40b3-a272-537c35de11d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\b9294509-b125-4cff-97c5-1a24ce167eae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6288
Entropy (8bit):	4.965658941008132
Encrypted:	false
SSDEEP:	96:stBqfdis1Ab9wXFN8zfs85eh6Cb7/x+6MhmuecmAeYOvZ2MO/EJ:stB1sjFNkfs88bV+FiAmxPOMJ
MD5:	C685F426FAAD18E310D71A78C02086E6
SHA1:	42FC33C1626257912F631BE6D626ED4468698E3E
SHA-256:	E2B9F00DDA09555D453AD7D5AA8EF5817EAD8F5AA2AB67ACD33E0971A8E50F5A
SHA-512:	73ABFF715157B649484249965AE832D30DF5A05CE61B9CB55F7083466975F8ACAA0E9B0AD081591268006B8FC2F5DD067667F2E9D03389209618F8681E27919E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370098677265021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370098677264737"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF2a53f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6288
Entropy (8bit):	4.965658941008132
Encrypted:	false
SSDEEP:	96:stBqfdis1Ab9wXFN8zfs85eh6Cb7/x+6MhmuecmAeYOvZ2MO/EJ:stB1sjFNkfs88bV+FiAmxPOMJ
MD5:	C685F426FAAD18E310D71A78C02086E6
SHA1:	42FC33C1626257912F631BE6D626ED4468698E3E
SHA-256:	E2B9F00DDA09555D453AD7D5AA8EF5817EAD8F5AA2AB67ACD33E0971A8E50F5A
SHA-512:	73ABFF715157B649484249965AE832D30DF5A05CE61B9CB55F7083466975F8ACAA0E9B0AD081591268006B8FC2F5DD067667F2E9D03389209618F8681E27919E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370098677265021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370098677264737"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF31a7e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6288
Entropy (8bit):	4.965658941008132
Encrypted:	false
SSDEEP:	96:stBqfdis1Ab9wXFN8zfs85eh6Cb7/x+6MhmuecmAeYOvZ2MO/EJ:stB1sjFNkfs88bV+FiAmxPOMJ
MD5:	C685F426FAAD18E310D71A78C02086E6
SHA1:	42FC33C1626257912F631BE6D626ED4468698E3E
SHA-256:	E2B9F00DDA09555D453AD7D5AA8EF5817EAD8F5AA2AB67ACD33E0971A8E50F5A
SHA-512:	73ABFF715157B649484249965AE832D30DF5A05CE61B9CB55F7083466975F8ACAA0E9B0AD081591268006B8FC2F5DD067667F2E9D03389209618F8681E27919E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370098677265021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370098677264737"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566393873619938
Encrypted:	false
SSDEEP:	768:tuXF4TWPu0fYP8F1+UoAYDCx9Tuqh0VfUC9xbog/OViTeXyrwTpGtuJ:tuXF4TWPu0fYPu1janKX3kta
MD5:	E1D5FA2843E9899D43E18D2E30522800
SHA1:	6AA9C53EDA4119D6A17DA48E018EF7ACEE73BED2
SHA-256:	236EAB7FC8CA74644E4A4C0DA9BFE583DFCEC1FD00CF63D11F0C6A53994EB46A
SHA-512:	D7DB6CAA654A61612A7D68B59276D034E46286F5457F14720A113EEA8F63E1D7DC03679FDC4C50C4EAC97AC02D842D666C568448051BBC492B67A8AEFCA631CE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370098676661773","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370098676661773","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF27303.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566393873619938
Encrypted:	false
SSDEEP:	768:tuXF4TWPu0fYP8F1+UoAYDCx9Tuqh0VfUC9xbog/OViTeXyrwTpGtuJ:tuXF4TWPu0fYPu1janKX3kta
MD5:	E1D5FA2843E9899D43E18D2E30522800
SHA1:	6AA9C53EDA4119D6A17DA48E018EF7ACEE73BED2
SHA-256:	236EAB7FC8CA74644E4A4C0DA9BFE583DFCEC1FD00CF63D11F0C6A53994EB46A
SHA-512:	D7DB6CAA654A61612A7D68B59276D034E46286F5457F14720A113EEA8F63E1D7DC03679FDC4C50C4EAC97AC02D842D666C568448051BBC492B67A8AEFCA631CE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370098676661773","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370098676661773","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.168239137305224
Encrypted:	false
SSDEEP:	6:PeqNFB1qLTwi23oH+TcwtSQM72KLllF3+q2PqLTwi23oH+TcwtSQMxIFUv:PeqgwZYeb0LnFOv8wZYebrFUv
MD5:	4956983F00E9D2E474F9AEF1A046158B
SHA1:	1AD88494B729900A2B45CC4AB2819A53C59A7BEE
SHA-256:	84FD198CF73B41FE6BFA0CD164C3A0CC8276B41275935402FBCF5DE69EE4D1C2
SHA-512:	A473BE1C4AB106FFEF59BAE08C75B819FFFEB4E68E92370E6F1F5E66BFBD730D9C72569E4CC705174832D95D172530779406DC8D18904BF8B161FA760ADDE729
Malicious:	false
Preview:	2024/09/06-08:18:13.412 19b8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/09/06-08:18:13.526 19b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.095002663709492
Encrypted:	false
SSDEEP:	6:PpyYb1qLTwi23oH+TcwtgUh2gr52KLllptbVq2PqLTwi23oH+TcwtgUh2ghZIFUv:PSwZYeb3hHJLnnbVv8wZYeb3hHh2FUv
MD5:	1F60037F3A4E2F6B1210802880585ABA
SHA1:	13906A32BB2BA38619AA9FE8DA103BDB8DDC7715
SHA-256:	209C98C70EF201D466C8B589D46ADAD13AB87E89EE73B2074EC4DDB9D5559437
SHA-512:	6795462168C51A1AEE04B087A2B8F90A948311C454B38D74941B438C6255CA976909B9BAC3135BA0F4265457E0E9BF8C70C514A272B577320C6AC2DC35008FDD
Malicious:	false
Preview:	2024/09/06-08:17:56.681 1fa0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/09/06-08:17:56.956 1fa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulS9Zwl/l:LsX9ZwX
MD5:	F8F729923D0039FFBFB04BC8308E66CD
SHA1:	5288BAFEB4D2FCDE03EFCD473C289A8A3744A72E
SHA-256:	23C55BD01C1FCCDC6370A6F031154F3F4457F02E2B2A87DCC85AD245C697F290
SHA-512:	BDE5A2D7A08275434CA9C8DC00848724236A19E7C252495DD7396AB111C2530824E349A9C0E9AE0215A26063819AF89D9024774EB716431E51266FF56A81D776
Malicious:	false
Preview:	........................................4...../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:NKo00EJEw:Y7JR
MD5:	D00206279A007FC918D7D41C6FBCEADF
SHA1:	86C989C76E36929D036FE3339DCD26C7DC691424
SHA-256:	4EC3A6E0DC23593B91CC6214CE913362FB0862583CACADD492C4FE9E30F3B717
SHA-512:	15E48EE4F461BA647BE1462901E2062EBECA954347F61BB85EAF037D9E6391E029E2145614B280D031BD102BB414F7C366A6AFFE93897A39A6CD6C1423FC4CB1
Malicious:	false
Preview:	(..../c.oy retne........................U.I.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:NKo00EJEw:Y7JR
MD5:	D00206279A007FC918D7D41C6FBCEADF
SHA1:	86C989C76E36929D036FE3339DCD26C7DC691424
SHA-256:	4EC3A6E0DC23593B91CC6214CE913362FB0862583CACADD492C4FE9E30F3B717
SHA-512:	15E48EE4F461BA647BE1462901E2062EBECA954347F61BB85EAF037D9E6391E029E2145614B280D031BD102BB414F7C366A6AFFE93897A39A6CD6C1423FC4CB1
Malicious:	false
Preview:	(..../c.oy retne........................U.I.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:uTEaHFjEQqTu:uTEaKq
MD5:	0F3545E0991A82898693B7CAEF2B5344
SHA1:	BD503654553214741FE933F162F5D7E3C3708D35
SHA-256:	325F497B02C58A8EE1613D3BD953C7D5E8DE80A8C981627A9D10238A3E8A05E9
SHA-512:	320022F61CEC2D59F59C0B87480C9DD9EDF5285FFA4A57F3064BCC7CACE654528F7475B3ADDAA4F68A0E536C0F1D8F6119FEB38C1A0474550F7D27F597E6DE76
Malicious:	false
Preview:	(...3...oy retne..........................J.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:uTEaHFjEQqTu:uTEaKq
MD5:	0F3545E0991A82898693B7CAEF2B5344
SHA1:	BD503654553214741FE933F162F5D7E3C3708D35
SHA-256:	325F497B02C58A8EE1613D3BD953C7D5E8DE80A8C981627A9D10238A3E8A05E9
SHA-512:	320022F61CEC2D59F59C0B87480C9DD9EDF5285FFA4A57F3064BCC7CACE654528F7475B3ADDAA4F68A0E536C0F1D8F6119FEB38C1A0474550F7D27F597E6DE76
Malicious:	false
Preview:	(...3...oy retne..........................J.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlS2Zwtl:Ls3S2K
MD5:	BBE8E5EC44C47154FE8DC5619D97D61D
SHA1:	948C5711BB73D117041EC87AC9D0C6E7ADBBDBE0
SHA-256:	7DCDA107A91A58DC71092702271C2470947E296D00F9BC710A4C740E36C45F87
SHA-512:	275474D137BF190C70E120C525F6A27AE27E0B4DB5F19CF60EE7DE88A3D208F6216CFBA5C2A6DE433DC63F5CF6930B5ACD6E3FC1ECE67F1991225EE309C04C9A
Malicious:	false
Preview:	..........................................S.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlUql/l:Ls3UqX
MD5:	7562190F3ED4AD61B16F080DC743BE3F
SHA1:	26DC1C866C8374A047724260586FDB44219304A2
SHA-256:	8578F8EC7F3EEBEAEF755A2DFEB23B0C020FC02203B8245EF0B41DAE9F3F24F8
SHA-512:	86632008C373567B9BF9F3584CBE73E8F93843DA1C16CA7CC068CC0922E25E3305344FA9F433B1C183B634C082D7C57BA8824E91A5C00190867D08FFE306B690
Malicious:	false
Preview:	........................................tqR.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	399
Entropy (8bit):	5.22875732253466
Encrypted:	false
SSDEEP:	12:Pcv+fwZYebqqBvFLn8vIv8wZYebqqBQFUv:XfwZYebq8La68wZYebqZ2
MD5:	CDF7463791C1A7B0ADDA7CB98C772C23
SHA1:	D8B24FBFFD710E7391C89608FE129B9BA99E5FCA
SHA-256:	E28120467FCC6C3753BD330E92C941552BC46230F101284B53C54A23A7DD21EF
SHA-512:	6521E04092CDF4CBEB4435F0C4568B42C510BB9C7AE07C2566A1B53F062CFC8FC78217A68F63A71D5728A2149A43D82A5EB5A092F3BD2418A431BCF4228DDC45
Malicious:	false
Preview:	2024/09/06-08:17:57.955 b88 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/09/06-08:17:57.991 b88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0551ca3b-442b-4d89-9c65-f71defb34475.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\961eee42-bd4e-462a-a063-8f0ebee54bce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9e1d7755-e076-4eb5-983e-430aad2233d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF334ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c8f0c668-82e0-446b-897e-b6592eb20a17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.207512504022883
Encrypted:	false
SSDEEP:	6:PSc3B1qLTwi23oH+Tcwt0jqEKj0QM72KLllH+N+q2PqLTwi23oH+Tcwt0jqEKj0f:PS9wZYebqqB6LneIv8wZYebqqBZFUv
MD5:	F9BBC8A7BCD6A2DFD21637151F9901ED
SHA1:	8A586BFB5AC53EB537B4A31AEDCC713BF78A36B8
SHA-256:	31F152D44991C661EF5AC2C6F00E810EF63A187D12D46C765B1F45372B7EB311
SHA-512:	72688590AC6704636F93A2A441F4C2B8FD856CABBA69E32D123179772D7FDC7569A015D7DC2BC787FEF8760C9D12C83B3C3F0D316896A51118902D367E77F1E6
Malicious:	false
Preview:	2024/09/06-08:18:13.876 19b8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/09/06-08:18:14.115 19b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.265141709815878
Encrypted:	false
SSDEEP:	6:Ppj/ERM1qLTwi23oH+Tcwtkx2KLllppq2PqLTwi23oH+TcwtCIFUv:PRERlwZYebkVLnPv8wZYebLFUv
MD5:	3636F2B8D73861FA3E5A34F584644A1E
SHA1:	8D7671935116B12E55713D20E6D27950D13C3F61
SHA-256:	BA3CCBD06B0A73F8805E8562F4F0EFF5CD9A8F28614BAC35504F54B1A43E87BA
SHA-512:	BAF9363E61689A2002964949A97BCB2C651E6DCBBFC7B04185CA9A2A9EB3EB936C8C8831888D28358BF3790323AEB3142F5AF0D736F2F0B075EBE367EC125112
Malicious:	false
Preview:	2024/09/06-08:17:56.783 1fb4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/09/06-08:17:57.079 1fb4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtV5D5:IiV
MD5:	BD9F67E68B21AA3E759F4EF8125CFCBF
SHA1:	9CDB18438C09BBD9E1AEF587726CF3CD3FDE29C0
SHA-256:	94C9AD16398DD26CA796963BEA12AD63966F0A549A493250AB9533F659AA9758
SHA-512:	C7C8EF5D7AB73FACC9634BD0C01497CA8B7F6D418E1C19DABDE22684C4B852DF8FED5AB4A4238CA1A9BC5AC04AA0F3EB210A0F5AF7017392A4C8AD05D7C881C9
Malicious:	false
Preview:	VLnk.....?........s...f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.076979669257685
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOTtSAE+WslKOMq+vVumYINn66:e/2qOB1nxCkOTtSAELyKOMq+vVumhp
MD5:	51E7551F4279FCA694B8CC9CA53FE6FE
SHA1:	942A05A6C29245F3F322402F6536F2EBDCDC9E0D
SHA-256:	E07D6EAAFE09FBABD9E8788583D5D574DABF08E26F546AC85525DF5B6A55C158
SHA-512:	9576FE5B53D6EF4723F7088B8D449B59517B08F73F4597D6BD1468548BD61AB96532C2577786D642F080675B397876379D91FB6A5A8C034F254F8166897EDC80
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\cfab5ac1-eed4-4f48-b65f-2f599248efca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.566275431759897
Encrypted:	false
SSDEEP:	768:tuXF4TWPu0fbP8F1+UoAYDCx9Tuqh0VfUC9xbog/OViTeXyrwfpGtuq:tuXF4TWPu0fbPu1janKX3wtJ
MD5:	2DB8327E190549193A853B17657D35D6
SHA1:	B01CAE58F4349A0AFFCC6195759388C629F53546
SHA-256:	94350AB166119166CA84285DAABD9081B10235755B45720F0137D7109852AB52
SHA-512:	5DE95FECD3AD0CB6E6E7303DC3B1D13FB8F836F9BBF7850CDA7D43A4F5AF398F8F5DD2F8D796A7FB2C3D19C4F8E832BAF20B6892D76F423EA453951A75F1B3FA
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370098676661773","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370098676661773","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\fd914717-ea34-4ae2-b3c9-33884c77fdf1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6288
Entropy (8bit):	4.965658941008132
Encrypted:	false
SSDEEP:	96:stBqfdis1Ab9wXFN8zfs85eh6Cb7/x+6MhmuecmAeYOvZ2MO/EJ:stB1sjFNkfs88bV+FiAmxPOMJ
MD5:	C685F426FAAD18E310D71A78C02086E6
SHA1:	42FC33C1626257912F631BE6D626ED4468698E3E
SHA-256:	E2B9F00DDA09555D453AD7D5AA8EF5817EAD8F5AA2AB67ACD33E0971A8E50F5A
SHA-512:	73ABFF715157B649484249965AE832D30DF5A05CE61B9CB55F7083466975F8ACAA0E9B0AD081591268006B8FC2F5DD067667F2E9D03389209618F8681E27919E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370098677265021","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13370098677264737"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/5zlFll:7+/l/5
MD5:	A559B96B071ABF979C40FFAA42AE4E32
SHA1:	30021D483045AC052046A9E2CD39C340294108C0
SHA-256:	495ECF95501935D121A813E83558A2107D49F059702179FE63B5C4FA9AB93D8B
SHA-512:	2FB6C4F86F4AA29057410C719B7D5CF33C6171FF6D86F09B10613D8086235A0F205EEBA581E61980FBC559EFD3F4EE8FD9FD576D3AA564585C9BAF106677EFB9
Malicious:	false
Preview:	.... .c.....\.Ak................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.05010601478646411
Encrypted:	false
SSDEEP:	6:GLW09Sv9W09SvgML9X8hslotGLNl0ml/XoQDeX:a9sN9sVGEjVl/XoQ
MD5:	653A6FBC9EA806221B816616AA2B468F
SHA1:	CA5B8E0BF96FCC9FE135B821A321A14CA42849E4
SHA-256:	3D979201977C2708D3F16D0B8739A3DFFAC6B7A137B2A94EE1205EC26199B1F9
SHA-512:	AA291EFEEC97D6780E0F6B9C703BE521E75D7E429EEE89A7689AC382F2F4AA5501C1296C06083C4DADD361A3626A407BDFDC6614711948E367E2CC72EDC446DE
Malicious:	false
Preview:	..-.......................'..}F.J0....r....Z..-.......................'..}F.J0....r....Z........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9997542258714684
Encrypted:	false
SSDEEP:	48:9zx2LUlO+A2cbX+/n9VAKAFXX+H2VAKAFXX+9dxOqVAKAFXX+RnUYVAKAFXX+ZAc:5xDAgsNsFNs97O5NsoNsZv
MD5:	D692CA1D97827C21E614F1390DE05E37
SHA1:	FADD60879E35F93714E38EA2D7922103AFAD1F84
SHA-256:	E846DF500F90105E569D8A6718E7D5B461E2AD177234F599135AABE1CB045164
SHA-512:	65FE1599E7FC513AF593307663AAE2634E92819A4E97D6EC0C15DCD754AE5606F6325BE89B5A06F2D7C28F49ED079982D31AADA6E4C2AF8FA2466B2887195C18
Malicious:	false
Preview:	7....-..........J0.....3]...........J0...8I...tTSQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1566
Entropy (8bit):	5.508370126159743
Encrypted:	false
SSDEEP:	48:gI8RSBSeQ9PwHRH2xEIYjIYmzGqkjMYjMY+qyFAlkfAlkL3S:50eQKIYjIYmzGbjMYjMYSYcYe3
MD5:	D34C0DB6F8764FD0654261BB570142A3
SHA1:	427EE4A715C476AA9ECA48B5C9D7CF7E95619C9C
SHA-256:	6E9133A32E2310D76F22798B31021C00B1AF1CD4A969DF7DCB0073619DBED9C3
SHA-512:	A1CC118A924C34DBE00A14ABB5CBF7B4CA5CC9A7EA9B8A8BAFF229CFB269E8DBDFC93BDA6E399D52A46CA51DE74B4A8E6FD0A98A8D42E6A700F74B0AF0C139C5
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f...............K./..................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceTrackingPageActionIconLabelFeature1.+IPH_PriceTrackingPageActionIconLabelFe

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.265402940633601
Encrypted:	false
SSDEEP:	6:Pp5yXHM1qLTwi23oH+Tcwt0rl2KLllpmyq2PqLTwi23oH+Tcwt0rK+IFUv:P+XHlwZYebeLnUyv8wZYeb13FUv
MD5:	75B61FA3D34E36800850E3B91E8C6186
SHA1:	2C3365270EBC6D4C3E2C877EA7ED04ABACDABDD5
SHA-256:	7CE21346AA440DB1A630C78093B21B1028AA463EE3237BC29E6EAD8514BBFC26
SHA-512:	AC6E20CED351B8E2D76E6287A5412E2DD7DB8CC3A4E84E6D3E042BFD1A23B1156A27967BFE2FC3D731623A10CECF69418B4A023139008B94DFAF0CD31AD8501A
Malicious:	false
Preview:	2024/09/06-08:17:57.345 1fa4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/09/06-08:17:57.360 1fa4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.923555399679033
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Wu2XZmh/U/ct2b/GnIwmC8mvRW:G0nYUtypD3ROmhC/B3
MD5:	96C84FAD661AA45297C5D11D51DEEBEB
SHA1:	4D24C3554A3E924329F09749BD7FE35EFBD01EAC
SHA-256:	AF96A332354A65C7373DC29CC7C8AB3BF6B0538B6B7447D5089615B06D14948C
SHA-512:	EF0B8D70EA418AF73EB3D5A8ECE37B54BE780B63075AB3988BA5B73B2231B8CB0D0CFC22093FBD3B8BE6AEF6B01DF9C390C22A06B962E0661CB0E5415D07223F
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....!....................3_.....n.b..................4_.........................20_........].................20_.....{a...................19_.....f.F..................18_.....7*X..................3_.....X....................4_.....eE,..................37_......0...................38_........'.................39_.....p.j..................9_......@o..................37_.....n5._.................38_.....LZa..................39_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.219940148040808
Encrypted:	false
SSDEEP:	6:PpqbXHM1qLTwi23oH+Tcwt0rzs52KLllpyyq2PqLTwi23oH+Tcwt0rzAdIFUv:PEbXHlwZYeb99Ln4yv8wZYebyFUv
MD5:	63D831DA8DE58822FCA36A1AC57A2199
SHA1:	3F5AA1F7902B69319BE4E21432577A878AB70580
SHA-256:	BFBA79F2124A72F41A3EE35AAE3D931C96B8232C6AF6C249A9127534496CCAD0
SHA-512:	6FDADF177DF367807324D3CCA2C8688A82CEA1E20180AD6F61EB6D9C6E754B1E42A6E71F4A4FEBC9725903BC7AA4A63A478B66A9E16FA0E16CEA08184BA3B41C
Malicious:	false
Preview:	2024/09/06-08:17:57.321 1fa4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/09/06-08:17:57.342 1fa4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl+ZQl:Ls3+Zw
MD5:	19717314040227AE3498A3AC14B5390D
SHA1:	B56AEF09F34893C144C6EAFE1B264AC3EF3DFFBF
SHA-256:	01936F2BF7D196A19E8DFAEFBC3420ED82A542D0EAF2F02068F196CA042BDD38
SHA-512:	30CFF8701CBC488383721943D36C7C7B5F9400DCC3914502805BA4AB8BED0C5D73A53352C2F5FCF92C37DB804707DFB8299248E8DCF1C29E2B83CFAF978C065A
Malicious:	false
Preview:	..........................................L.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlEXl:Ls3E1
MD5:	8C7C2A4447B497E804A22380CA291FFA
SHA1:	BFA9870CFE735746522D0CAD7DE8B0092D2A38B4
SHA-256:	8BE9968BE93273D3774BEEC34C2EC3563B321932EE04D9386CBCE334E5DDE2E6
SHA-512:	8CFB96699164AFD91FE47C88DC89177B172840308F3A81328111A549B625D8D97ECC923F753A778D31A38165784963D3C8B147710562E28A8FE7D3F018CEE270
Malicious:	false
Preview:	..........................................M.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5607307501957655
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtw59850MnBLlGtOoHyikJsJdXmuBuwB9Waid93Nhkzk3XDQQRZ:YuBqDPaf+9853BLktv2KRBzBAJdBkzG9
MD5:	1C7F6A8757668331D5DE93D64835FC7A
SHA1:	9D8EAA2AE496060C5FA50DEF6C0F12CE821472B5
SHA-256:	7BF2C4BC2FA353E3F3CAC570EF75A2292D0479F4FB463550A11B8BC6A8507458
SHA-512:	95881F89CBF2A359196E827552EFFCC03DF2B0B2AD5884B27B44F9993D4A4259A96BFF805C45A06BB051AF62298C50715D1CCC9048A13A1D4F434BEF47274634
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370098675948580","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725625075"},"user_experien

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF20768.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5607307501957655
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtw59850MnBLlGtOoHyikJsJdXmuBuwB9Waid93Nhkzk3XDQQRZ:YuBqDPaf+9853BLktv2KRBzBAJdBkzG9
MD5:	1C7F6A8757668331D5DE93D64835FC7A
SHA1:	9D8EAA2AE496060C5FA50DEF6C0F12CE821472B5
SHA-256:	7BF2C4BC2FA353E3F3CAC570EF75A2292D0479F4FB463550A11B8BC6A8507458
SHA-512:	95881F89CBF2A359196E827552EFFCC03DF2B0B2AD5884B27B44F9993D4A4259A96BFF805C45A06BB051AF62298C50715D1CCC9048A13A1D4F434BEF47274634
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370098675948580","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725625075"},"user_experien

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF20778.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5607307501957655
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtw59850MnBLlGtOoHyikJsJdXmuBuwB9Waid93Nhkzk3XDQQRZ:YuBqDPaf+9853BLktv2KRBzBAJdBkzG9
MD5:	1C7F6A8757668331D5DE93D64835FC7A
SHA1:	9D8EAA2AE496060C5FA50DEF6C0F12CE821472B5
SHA-256:	7BF2C4BC2FA353E3F3CAC570EF75A2292D0479F4FB463550A11B8BC6A8507458
SHA-512:	95881F89CBF2A359196E827552EFFCC03DF2B0B2AD5884B27B44F9993D4A4259A96BFF805C45A06BB051AF62298C50715D1CCC9048A13A1D4F434BEF47274634
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370098675948580","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725625075"},"user_experien

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2097c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5607307501957655
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtw59850MnBLlGtOoHyikJsJdXmuBuwB9Waid93Nhkzk3XDQQRZ:YuBqDPaf+9853BLktv2KRBzBAJdBkzG9
MD5:	1C7F6A8757668331D5DE93D64835FC7A
SHA1:	9D8EAA2AE496060C5FA50DEF6C0F12CE821472B5
SHA-256:	7BF2C4BC2FA353E3F3CAC570EF75A2292D0479F4FB463550A11B8BC6A8507458
SHA-512:	95881F89CBF2A359196E827552EFFCC03DF2B0B2AD5884B27B44F9993D4A4259A96BFF805C45A06BB051AF62298C50715D1CCC9048A13A1D4F434BEF47274634
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370098675948580","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725625075"},"user_experien

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2098b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5607307501957655
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtw59850MnBLlGtOoHyikJsJdXmuBuwB9Waid93Nhkzk3XDQQRZ:YuBqDPaf+9853BLktv2KRBzBAJdBkzG9
MD5:	1C7F6A8757668331D5DE93D64835FC7A
SHA1:	9D8EAA2AE496060C5FA50DEF6C0F12CE821472B5
SHA-256:	7BF2C4BC2FA353E3F3CAC570EF75A2292D0479F4FB463550A11B8BC6A8507458
SHA-512:	95881F89CBF2A359196E827552EFFCC03DF2B0B2AD5884B27B44F9993D4A4259A96BFF805C45A06BB051AF62298C50715D1CCC9048A13A1D4F434BEF47274634
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370098675948580","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725625075"},"user_experien

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2309b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5607307501957655
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtw59850MnBLlGtOoHyikJsJdXmuBuwB9Waid93Nhkzk3XDQQRZ:YuBqDPaf+9853BLktv2KRBzBAJdBkzG9
MD5:	1C7F6A8757668331D5DE93D64835FC7A
SHA1:	9D8EAA2AE496060C5FA50DEF6C0F12CE821472B5
SHA-256:	7BF2C4BC2FA353E3F3CAC570EF75A2292D0479F4FB463550A11B8BC6A8507458
SHA-512:	95881F89CBF2A359196E827552EFFCC03DF2B0B2AD5884B27B44F9993D4A4259A96BFF805C45A06BB051AF62298C50715D1CCC9048A13A1D4F434BEF47274634
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370098675948580","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725625075"},"user_experien

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF27209.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5607307501957655
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtw59850MnBLlGtOoHyikJsJdXmuBuwB9Waid93Nhkzk3XDQQRZ:YuBqDPaf+9853BLktv2KRBzBAJdBkzG9
MD5:	1C7F6A8757668331D5DE93D64835FC7A
SHA1:	9D8EAA2AE496060C5FA50DEF6C0F12CE821472B5
SHA-256:	7BF2C4BC2FA353E3F3CAC570EF75A2292D0479F4FB463550A11B8BC6A8507458
SHA-512:	95881F89CBF2A359196E827552EFFCC03DF2B0B2AD5884B27B44F9993D4A4259A96BFF805C45A06BB051AF62298C50715D1CCC9048A13A1D4F434BEF47274634
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370098675948580","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725625075"},"user_experien

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2f33f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5607307501957655
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtw59850MnBLlGtOoHyikJsJdXmuBuwB9Waid93Nhkzk3XDQQRZ:YuBqDPaf+9853BLktv2KRBzBAJdBkzG9
MD5:	1C7F6A8757668331D5DE93D64835FC7A
SHA1:	9D8EAA2AE496060C5FA50DEF6C0F12CE821472B5
SHA-256:	7BF2C4BC2FA353E3F3CAC570EF75A2292D0479F4FB463550A11B8BC6A8507458
SHA-512:	95881F89CBF2A359196E827552EFFCC03DF2B0B2AD5884B27B44F9993D4A4259A96BFF805C45A06BB051AF62298C50715D1CCC9048A13A1D4F434BEF47274634
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370098675948580","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725625075"},"user_experien

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF31a4f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5607307501957655
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtw59850MnBLlGtOoHyikJsJdXmuBuwB9Waid93Nhkzk3XDQQRZ:YuBqDPaf+9853BLktv2KRBzBAJdBkzG9
MD5:	1C7F6A8757668331D5DE93D64835FC7A
SHA1:	9D8EAA2AE496060C5FA50DEF6C0F12CE821472B5
SHA-256:	7BF2C4BC2FA353E3F3CAC570EF75A2292D0479F4FB463550A11B8BC6A8507458
SHA-512:	95881F89CBF2A359196E827552EFFCC03DF2B0B2AD5884B27B44F9993D4A4259A96BFF805C45A06BB051AF62298C50715D1CCC9048A13A1D4F434BEF47274634
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370098675948580","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725625075"},"user_experien

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF377d1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5607307501957655
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtw59850MnBLlGtOoHyikJsJdXmuBuwB9Waid93Nhkzk3XDQQRZ:YuBqDPaf+9853BLktv2KRBzBAJdBkzG9
MD5:	1C7F6A8757668331D5DE93D64835FC7A
SHA1:	9D8EAA2AE496060C5FA50DEF6C0F12CE821472B5
SHA-256:	7BF2C4BC2FA353E3F3CAC570EF75A2292D0479F4FB463550A11B8BC6A8507458
SHA-512:	95881F89CBF2A359196E827552EFFCC03DF2B0B2AD5884B27B44F9993D4A4259A96BFF805C45A06BB051AF62298C50715D1CCC9048A13A1D4F434BEF47274634
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"profile":{"info_cache":{},"profile_counts_reported":"13370098675948580","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":false},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725625075"},"user_experien

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlctla/l:Ls3cXe
MD5:	5A7E7CBA53BEA4B291794493AB5704F1
SHA1:	A436252049607FE7213B86335F1C466F262CD4BF
SHA-256:	8E3CFF7BD6261210701F1577FFD1DE261AD546FBEE2B25FB9E7589E7E05A694B
SHA-512:	9C7EEDCDDA2F79B403CF8DC550381531AB2BE4366485E151E9EE4D3E62CAFD1F11D24653799887F3E8DDBC14CFE2D64513C8D35187E2B1E9AD2A6445A72391CC
Malicious:	false
Preview:	..........................................1.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\bc96ec91-cf8f-4896-9729-fc5a3edb88ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20784
Entropy (8bit):	6.064697977171984
Encrypted:	false
SSDEEP:	384:RtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSModq4aJPNgnZODbSv:LMGQ7FCYXGIgtDAWtJ4n7q4aJVQa6
MD5:	E29C2EC872D9DBA626E19AEEF2CA54D6
SHA1:	14D05F759F1FFF7A0FD26C4F6D7DFD8FC57E64DD
SHA-256:	AFAAD68E7A6D905471D78503BB0DDD5573DE2EDF6CA6CC67112D970D871AB784
SHA-512:	41CF411A717BEC89C19E86C24C0E1649A95B3877A83510934FF00CCEAF8C82A8C38DF2A2A36F0CA0E29EFD3FE658406DA057F7512A1D67E8C5E25B2E493A5A00
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411jYlhlRsBQRm+LIWvOaiW4hdcyEra5fCtzINfylY7VRB4y

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\f4405a0f-55d8-4b1f-bc40-55733b373d7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2959
Entropy (8bit):	5.589943132273723
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0af+9853BLktb2KNHB+TtdrxbvBAJdekvR4ysaJkX5cwYwlRvp:Xq8NkC1f+O5xLktb2MBqpvCJd74yVJkl
MD5:	0D6EA45D52D9AD979DB4EFA8CFD5A358
SHA1:	02A8AEA85C547586EB4E74713851258279E66E80
SHA-256:	E9A67E2CB85CA76BD5E9B19C048AA9036B5CF2318EF019E8CD83FE0F3FC72340
SHA-512:	B240957E2C27504EBB7C4AE48EF736CBC16CBE9E24FB3A622468FA95FA3CA6EBA04C61833916A97DF915B30181C88512276FD43A871F28E6A182A56B0B271DF0
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACtY5c84U3OTqhLx0jd2sZ/EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACE/yj6Q5VmDE32xvHuySjQZv5Ck6vQrULTRqoeZXM9CQAAAAAOgAAAAAIAACAAAAB8cV61W58etmeCHkRRDgRSlRQ6lwehj20I/V5HfMs5mzAAAABR5M1zGuhyG9RJ2fkzDAr46UO9i/haeysye/QfGTAdbQvF7WlMJX+guB4VE6NVnWRAAAAApFkWMM/iHfzvhgj7+7N8X/rJDiWlkPWKalnPcSjNzspF9oXMi917d/aNLTjrjsHTfFTSFREQKZ6R6I+iL5LIBA=="},"policy":{"last_statistics_update":"13370098675975583"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\f6bb8fb3-ef77-4086-9522-7d0626556d07.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	70114
Entropy (8bit):	6.072465020255722
Encrypted:	false
SSDEEP:	1536:LMGQ5XMBGUtp6pE2LNUqJfNW0MhiO/nQFzrILna6:LMrJM8EpG5JWr/QFzrILf
MD5:	D066FF33FC68B733B156A2F19CE2804C
SHA1:	EC660161B7D98CCB71457A29D2C2C0034A8596F5
SHA-256:	2AE62B50AD18DA57A425F7507D83EBABFFBABED3CF35E63F3FB349A7D2A3E13D
SHA-512:	9161B9EFD5FE08C3F98BC700EC9544E6EF47AE259A342DB0B3E96C6D29F6E6A2CB5620BFEE3DC579F729B8056E057D28CC8F1FC83831DCB18206594C591B2224
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411jYlhlRsBQRm+LIWvOaiW4hdcyEra5fCtzINfylY7VRB4y

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\000ff06c-481a-483b-bae5-df08cc5e2772.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58953
Entropy (8bit):	6.104465376228589
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yOjCBS2qX7bxwgorQXdbiR3oM:z/0+zI7yOjkS20HXdbe3
MD5:	05874FCAA4BE191F87DB0F7E61BFD9D7
SHA1:	D491135B1DA4199005ECAEF0FBA8047FF44BCEDD
SHA-256:	6B1319E40FAD86F8CB89D5C7B0EDDF0F2CC150972017393DAAEB92F8BA0F1A14
SHA-512:	17DC07C745E27937D9A107C1B69F09783AFF52750A9A2FFE7EFBA1C13D148C67BC273A0ADCC14B78BECE7207B68A1FD4195E8CBB2B3CE47EF0DF979FE2736AED
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\24aa75ed-d2cd-4822-aa53-fbf9e7ae0fd7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58952
Entropy (8bit):	6.104480292070398
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yOSCBS2qX7bKwgorQXdbiR3oM:z/0+zI7yOSkS20kXdbe3
MD5:	D9AA2211540BC6CB97BDAAA13EFDC614
SHA1:	2C373DC3461B61D07D17CB4E039410952F0A1800
SHA-256:	5225C46861E5AF8D8E99B26BA9F6C16095B69003F576AEB4AB47D08544246181
SHA-512:	72406D476D1DCAFB4B7A9BEBB627D686DBCF52E88BCFEA00C829D5788B308DC6058DB1BD8AF642813D9D7BACF09D2CC79B2B939C01FA4607415CB892ABADEB2B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\897bc5e9-3fae-4896-990c-962ae19b7aac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101680411106963
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLCBS2qX7bptPHgorQXdbiR3oM:z/0+zI7ynLkS205tP0Xdbe3
MD5:	17F40A6607EB2436F0A052CC6293457A
SHA1:	5CF84A56AACE509E06B46FF60B8DC6D81CDFA3B5
SHA-256:	4BA71BA8F71959430AB01470745200D6583A03F813683A8E202F5A70EABA58F8
SHA-512:	1BD379281C42B5E128ED7FFACA37C2098C4D2D7793F271C9D0856526CDBADCEFEC630C4AD51585840DC749B51BDC30E9258BF34C17A7B80861431E49BEF65A7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66DAF305-1E50.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.14697146951177842
Encrypted:	false
SSDEEP:	1536:PuZFU/LUg3mSqs2eJyQRGPAIeosO7z+RG:PKFywg3mSIekdPAIyO7z3
MD5:	5EB8A23E55F990BA8B7B890084316345
SHA1:	16133748B32A0ACF13C1BF52EA58E52E7E93BBFF
SHA-256:	8AD1863B82A046E42680224A34D996DF014B7D6CD35BA9484CD3EB827B299CFA
SHA-512:	7E14F692C433FF0ADC44A25911A49C64CE88C69C875E8DF0EDB57075ABB72B10DF64546D2CB5B0C2763AB2E926E8774A630391517EB5EA1A3DA8587BAB9FA2D8
Malicious:	false
Preview:	...@..@...@.....C.].....@................S..`C..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".gxnhgb20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U].0r........>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.................. .2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66DAF30D-878.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.14456419056686465
Encrypted:	false
SSDEEP:	768:RQjtFIXweInUY2Z1dHr/lbrTcRGO09bEsrUfWTTXJZRGO:RQZFIgeIUY8jr/lbrIRGt8unXJZRG
MD5:	08DB1EE8E0A2C7F93C5749EB80AA5A88
SHA1:	985B0094A9B2EBF94F9C4FE3F0850F78C497DEED
SHA-256:	7EADFE9D2E7E2933A448475E05C09A55949AF1DAEBDEE8472CA6AB8575AC10CE
SHA-512:	58BED5317B943D430514432C400CDF96C6DC0C08B6E7EDF10F422FB75825291DB8969CE21304CAB03A33A38AA8D5FF1A4F1BC124CCDA09F2F5E43C93DD0E91B7
Malicious:	false
Preview:	...@..@...@.....C.].....@............... ..................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".gxnhgb20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U].0r........>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.1326399824826066
Encrypted:	false
SSDEEP:	3:FiWWltlT0EiCjG2xo6kMWPGdV8B+BVP/Sh/JzvXEAAG34tTAUFVHTtOllt:o1AGGwwMWj+BVsJDkG3V80/
MD5:	DB0B5F32DD6A247AE52AF2E9280D22D6
SHA1:	DF845EBCFC1E637F3A8674D6F24D1206637C358A
SHA-256:	20F50A96662CC19C9EA2D5C00F8FEECC0FFBD4B6290102C46CB7BB8B1B9CBFAE
SHA-512:	87962BBB3C6F8B5AE66B669B2B24C772E7CBA73C9AF57F57BF05657B5FDADB53B6DDD84914D4C465241591B26F07C61E358AC77A5E35281AE0EBFA13FA2EF14D
Malicious:	false
Preview:	sdPC.......................c.CsJ......5"93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................e9a6470b-82e9-4451-b995-4e1980b580b6............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\10c3ada2-d233-46d9-85c5-3a711e410163.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3a162928-b2d9-475f-825a-c554861a7234.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\740bdaf9-d471-4f66-b6c7-d3d54d4b2274.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7636
Entropy (8bit):	5.079657934817035
Encrypted:	false
SSDEEP:	96:stnqKfs1zbDsz9FsXEmZ4uof8znsY5eh6Cb7/x+6MhmuecmAeWnf+0DQ0ACML/EJ:stnfsiJFsJZeknsY8bV+FiA9+qcbLMJ
MD5:	3F5476FEFF63955D307F915B1ADA9D14
SHA1:	714A7F2D858BA4E5B5F8A5E096FC9355B73702D4
SHA-256:	91F492BCBBA85524D555525961F279EAF853E86F136C41DABA5BEB90D48445F6
SHA-512:	E949DB482FDC0E66540B9D8ED548B11CA816B91E94D2EE1838229EC9EBE4409B1178BC03E1D2CBF41FDBD8259C1A82711FFC68A08D316EF03D58C53331C30BA5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370098693797487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13370098693797198"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7f0df7d5-b061-455c-b370-40f0d99f6858.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.232152993188271
Encrypted:	false
SSDEEP:	6:PcsN9+q2PqLTwi23oH+TcwtnG2tMsIFUt82czhJZmw+2czh9VkwOqLTwi23oH+TR:PNN4v8wZYebn9GFUt82IhJ/+2IhD5TwL
MD5:	517BAE41B0280C48F31107EF3808E780
SHA1:	7404C535297B4BF105A49EB6560EA60B2FC16DAE
SHA-256:	532CF5A16360382240F257D4998CCB541B99733479D982A6CA18480B63D8B8F3
SHA-512:	1C7092A5D4EA725B22AD2613B83DC5944F91DC0C2C47C9B9FBD955AB43DCA7C1ADA9FA4801F802AE69C3326939120842E9AFCD51950EA7E2E085C5E8E57265C0
Malicious:	false
Preview:	2024/09/06-08:18:13.684 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/09/06-08:18:13.685 1db8 Recovering log #3.2024/09/06-08:18:13.685 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.232152993188271
Encrypted:	false
SSDEEP:	6:PcsN9+q2PqLTwi23oH+TcwtnG2tMsIFUt82czhJZmw+2czh9VkwOqLTwi23oH+TR:PNN4v8wZYebn9GFUt82IhJ/+2IhD5TwL
MD5:	517BAE41B0280C48F31107EF3808E780
SHA1:	7404C535297B4BF105A49EB6560EA60B2FC16DAE
SHA-256:	532CF5A16360382240F257D4998CCB541B99733479D982A6CA18480B63D8B8F3
SHA-512:	1C7092A5D4EA725B22AD2613B83DC5944F91DC0C2C47C9B9FBD955AB43DCA7C1ADA9FA4801F802AE69C3326939120842E9AFCD51950EA7E2E085C5E8E57265C0
Malicious:	false
Preview:	2024/09/06-08:18:13.684 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/09/06-08:18:13.685 1db8 Recovering log #3.2024/09/06-08:18:13.685 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old~RF26bfe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.232152993188271
Encrypted:	false
SSDEEP:	6:PcsN9+q2PqLTwi23oH+TcwtnG2tMsIFUt82czhJZmw+2czh9VkwOqLTwi23oH+TR:PNN4v8wZYebn9GFUt82IhJ/+2IhD5TwL
MD5:	517BAE41B0280C48F31107EF3808E780
SHA1:	7404C535297B4BF105A49EB6560EA60B2FC16DAE
SHA-256:	532CF5A16360382240F257D4998CCB541B99733479D982A6CA18480B63D8B8F3
SHA-512:	1C7092A5D4EA725B22AD2613B83DC5944F91DC0C2C47C9B9FBD955AB43DCA7C1ADA9FA4801F802AE69C3326939120842E9AFCD51950EA7E2E085C5E8E57265C0
Malicious:	false
Preview:	2024/09/06-08:18:13.684 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/09/06-08:18:13.685 1db8 Recovering log #3.2024/09/06-08:18:13.685 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.181147001075009
Encrypted:	false
SSDEEP:	6:Pc9yq2PqLTwi23oH+Tcwt8aPrqIFUt82c4r1Zmw+2c49RkwOqLTwi23oH+Tcwt8h:Pjv8wZYebL3FUt82Jr1/+2J75TwZYebc
MD5:	BB3ECA6F368373DA74DA3794A1E5FB62
SHA1:	2C987A8A72CE994346412E2521F715FBEA1F06B1
SHA-256:	A8262381A6EFE60EBCD20DC6EDF00E731B6AB0420D0F4F2CB7BEA2F2A66B36EA
SHA-512:	7C382D854E10E76279F5312BA3349AE11766186543968046529642733665D4994403C751C23DD23D2A82D1C2A4E916EABE25DFBD6F465370D6FD8AEAC8304C5C
Malicious:	false
Preview:	2024/09/06-08:18:13.688 150 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/09/06-08:18:13.689 150 Recovering log #3.2024/09/06-08:18:13.689 150 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.181147001075009
Encrypted:	false
SSDEEP:	6:Pc9yq2PqLTwi23oH+Tcwt8aPrqIFUt82c4r1Zmw+2c49RkwOqLTwi23oH+Tcwt8h:Pjv8wZYebL3FUt82Jr1/+2J75TwZYebc
MD5:	BB3ECA6F368373DA74DA3794A1E5FB62
SHA1:	2C987A8A72CE994346412E2521F715FBEA1F06B1
SHA-256:	A8262381A6EFE60EBCD20DC6EDF00E731B6AB0420D0F4F2CB7BEA2F2A66B36EA
SHA-512:	7C382D854E10E76279F5312BA3349AE11766186543968046529642733665D4994403C751C23DD23D2A82D1C2A4E916EABE25DFBD6F465370D6FD8AEAC8304C5C
Malicious:	false
Preview:	2024/09/06-08:18:13.688 150 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/09/06-08:18:13.689 150 Recovering log #3.2024/09/06-08:18:13.689 150 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.188083874888658
Encrypted:	false
SSDEEP:	6:Pcfyq2PqLTwi23oH+Tcwt865IFUt82cJ1Zmw+2cS1RkwOqLTwi23oH+Tcwt86+Ud:Pxv8wZYeb/WFUt82q1/+2pD5TwZYeb/L
MD5:	320061207911484F317A0546FF63E155
SHA1:	23DC4910C45747BFF20687A773D2476B37197F1A
SHA-256:	D7D0D974B06CF45F3950F9B65B2D9B20190A3DFB9836A254204F6AF4B550CAF9
SHA-512:	DE8C334D061C11C2178347D72A9820AF13A7DFC9575890503EA510E468526752A078275010DAE6A4D95408C8FB233304113CE103EC69C91A69C35A2A9B43CC6E
Malicious:	false
Preview:	2024/09/06-08:18:13.691 150 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/09/06-08:18:13.691 150 Recovering log #3.2024/09/06-08:18:13.692 150 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.188083874888658
Encrypted:	false
SSDEEP:	6:Pcfyq2PqLTwi23oH+Tcwt865IFUt82cJ1Zmw+2cS1RkwOqLTwi23oH+Tcwt86+Ud:Pxv8wZYeb/WFUt82q1/+2pD5TwZYeb/L
MD5:	320061207911484F317A0546FF63E155
SHA1:	23DC4910C45747BFF20687A773D2476B37197F1A
SHA-256:	D7D0D974B06CF45F3950F9B65B2D9B20190A3DFB9836A254204F6AF4B550CAF9
SHA-512:	DE8C334D061C11C2178347D72A9820AF13A7DFC9575890503EA510E468526752A078275010DAE6A4D95408C8FB233304113CE103EC69C91A69C35A2A9B43CC6E
Malicious:	false
Preview:	2024/09/06-08:18:13.691 150 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/09/06-08:18:13.691 150 Recovering log #3.2024/09/06-08:18:13.692 150 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	914FD8DC5F9A741C6947E1AB12A9D113
SHA1:	6529EFE14E7B0BEA47D78B147243096408CDAAE4
SHA-256:	8BE3C96EE64B5D2768057EA1C4D1A70F40A0041585F3173806E2278E9300960B
SHA-512:	2862BF83C061414EFA2AC035FFC25BA9C4ED523B430FDEEED4974F55D4450A62766C2E799D0ACDB8269210078547048ACAABFD78EDE6AB91133E30F6B5EBFFBD
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.199712384278616
Encrypted:	false
SSDEEP:	6:PadVq2PqLTwi23oH+Tcwt8NIFUt82aIgZmw+2aIIkwOqLTwi23oH+Tcwt8+eLJ:PaXv8wZYebpFUt82ax/+2ar5TwZYebqJ
MD5:	5B9E34FC06B6442EDF2EA169894EFE13
SHA1:	A20007B98E0384AE8F29FD6D869FA8468BBD34BC
SHA-256:	720ADF16D98576E5FEA0AA20E8DC2E051950057416BB504411CA7670FC822F14
SHA-512:	3D7A75F7A67A871B59A0A13147E2A41247E2109763C8DCC4B5CC4DB9609F6666026214A26E4E5D6DAF6EE630294D839333A8164F73D35516EC8AB4A0B16F52A3
Malicious:	false
Preview:	2024/09/06-08:18:13.938 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/06-08:18:13.939 1db4 Recovering log #3.2024/09/06-08:18:13.939 1db4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.199712384278616
Encrypted:	false
SSDEEP:	6:PadVq2PqLTwi23oH+Tcwt8NIFUt82aIgZmw+2aIIkwOqLTwi23oH+Tcwt8+eLJ:PaXv8wZYebpFUt82ax/+2ar5TwZYebqJ
MD5:	5B9E34FC06B6442EDF2EA169894EFE13
SHA1:	A20007B98E0384AE8F29FD6D869FA8468BBD34BC
SHA-256:	720ADF16D98576E5FEA0AA20E8DC2E051950057416BB504411CA7670FC822F14
SHA-512:	3D7A75F7A67A871B59A0A13147E2A41247E2109763C8DCC4B5CC4DB9609F6666026214A26E4E5D6DAF6EE630294D839333A8164F73D35516EC8AB4A0B16F52A3
Malicious:	false
Preview:	2024/09/06-08:18:13.938 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/06-08:18:13.939 1db4 Recovering log #3.2024/09/06-08:18:13.939 1db4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old~RF26c1e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.199712384278616
Encrypted:	false
SSDEEP:	6:PadVq2PqLTwi23oH+Tcwt8NIFUt82aIgZmw+2aIIkwOqLTwi23oH+Tcwt8+eLJ:PaXv8wZYebpFUt82ax/+2ar5TwZYebqJ
MD5:	5B9E34FC06B6442EDF2EA169894EFE13
SHA1:	A20007B98E0384AE8F29FD6D869FA8468BBD34BC
SHA-256:	720ADF16D98576E5FEA0AA20E8DC2E051950057416BB504411CA7670FC822F14
SHA-512:	3D7A75F7A67A871B59A0A13147E2A41247E2109763C8DCC4B5CC4DB9609F6666026214A26E4E5D6DAF6EE630294D839333A8164F73D35516EC8AB4A0B16F52A3
Malicious:	false
Preview:	2024/09/06-08:18:13.938 1db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/09/06-08:18:13.939 1db4 Recovering log #3.2024/09/06-08:18:13.939 1db4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7636
Entropy (8bit):	5.079657934817035
Encrypted:	false
SSDEEP:	96:stnqKfs1zbDsz9FsXEmZ4uof8znsY5eh6Cb7/x+6MhmuecmAeWnf+0DQ0ACML/EJ:stnfsiJFsJZeknsY8bV+FiA9+qcbLMJ
MD5:	3F5476FEFF63955D307F915B1ADA9D14
SHA1:	714A7F2D858BA4E5B5F8A5E096FC9355B73702D4
SHA-256:	91F492BCBBA85524D555525961F279EAF853E86F136C41DABA5BEB90D48445F6
SHA-512:	E949DB482FDC0E66540B9D8ED548B11CA816B91E94D2EE1838229EC9EBE4409B1178BC03E1D2CBF41FDBD8259C1A82711FFC68A08D316EF03D58C53331C30BA5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370098693797487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13370098693797198"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF26c9b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7636
Entropy (8bit):	5.079657934817035
Encrypted:	false
SSDEEP:	96:stnqKfs1zbDsz9FsXEmZ4uof8znsY5eh6Cb7/x+6MhmuecmAeWnf+0DQ0ACML/EJ:stnfsiJFsJZeknsY8bV+FiA9+qcbLMJ
MD5:	3F5476FEFF63955D307F915B1ADA9D14
SHA1:	714A7F2D858BA4E5B5F8A5E096FC9355B73702D4
SHA-256:	91F492BCBBA85524D555525961F279EAF853E86F136C41DABA5BEB90D48445F6
SHA-512:	E949DB482FDC0E66540B9D8ED548B11CA816B91E94D2EE1838229EC9EBE4409B1178BC03E1D2CBF41FDBD8259C1A82711FFC68A08D316EF03D58C53331C30BA5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13370098693797487","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13370098693797198"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	5.569051864382412
Encrypted:	false
SSDEEP:	768:rBkLBSWPQDfA/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8twrUrwadpFtuU:rBkLBSWPQDfA/u1jaROrNaRt/
MD5:	3E90564596C7837FB1460E16D9AE89CB
SHA1:	B3EAC16D4520A2D4DCC92B10B405F2C4B6858091
SHA-256:	AB6DDAE559A854DC4E2AAC4CEC9846631A38ADC5CAB53CD74D249157252EDFC6
SHA-512:	EF23A5026AEFAA64780006D682DE2F72A1D69200982C4567415AA898E3705E828605C9CDE37FAE7E96D503A0849684D9D60AEE59C87E7FFFAE2A236A760C935A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370098693621031","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370098693621031","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.119800699724036
Encrypted:	false
SSDEEP:	6:PHjc9q2PqLTwi23oH+TcwtrQMxIFUt82HVAvZZmw+2HCFkwOqLTwi23oH+Tcwtrb:PDEv8wZYebCFUt82Kh/+2iF5TwZYebtJ
MD5:	4FE5D4A7754514A5AA322951C60B584D
SHA1:	3BC9BDCBC608BAD5C42C31124149558F4181EA5F
SHA-256:	30B765492ED972269DE6E8C2D82C45911632076230C2B8903E144160526EF46B
SHA-512:	37534388D990C56C5326673A114CE2AD271DEE8B09A1CE232F5504DA0CBF5057BA55C73F900AFAB689394BBC1CA5B89AD939F269DD39D54074F48882A56CA9BD
Malicious:	false
Preview:	2024/09/06-08:18:14.299 7e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/06-08:18:14.300 7e0 Recovering log #3.2024/09/06-08:18:14.304 7e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.119800699724036
Encrypted:	false
SSDEEP:	6:PHjc9q2PqLTwi23oH+TcwtrQMxIFUt82HVAvZZmw+2HCFkwOqLTwi23oH+Tcwtrb:PDEv8wZYebCFUt82Kh/+2iF5TwZYebtJ
MD5:	4FE5D4A7754514A5AA322951C60B584D
SHA1:	3BC9BDCBC608BAD5C42C31124149558F4181EA5F
SHA-256:	30B765492ED972269DE6E8C2D82C45911632076230C2B8903E144160526EF46B
SHA-512:	37534388D990C56C5326673A114CE2AD271DEE8B09A1CE232F5504DA0CBF5057BA55C73F900AFAB689394BBC1CA5B89AD939F269DD39D54074F48882A56CA9BD
Malicious:	false
Preview:	2024/09/06-08:18:14.299 7e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/09/06-08:18:14.300 7e0 Recovering log #3.2024/09/06-08:18:14.304 7e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.178131801134291
Encrypted:	false
SSDEEP:	6:PcI9+q2PqLTwi23oH+Tcwt7Uh2ghZIFUt82cZXJZmw+2cZX9VkwOqLTwi23oH+T8:Pp4v8wZYebIhHh2FUt82IJ/+2ID5TwZ0
MD5:	008D3D94141E4C4D2E89687329ED91E5
SHA1:	40D6D1F352641653A4D49AA6A64C411060DD0A8F
SHA-256:	81CAD6327EB627D0B8660E01FC7824F924FE06718F81777F169B4450805C7D9E
SHA-512:	096AF1660987A20EE61F9AF36DDB4324633A968DE867CE33E29FA18804A7B52CFB3CD0529C4CC16353BEBC9D30DB8FE06FE99FFE743EC1A67A9436654742B578
Malicious:	false
Preview:	2024/09/06-08:18:13.677 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/06-08:18:13.678 1db8 Recovering log #3.2024/09/06-08:18:13.678 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.178131801134291
Encrypted:	false
SSDEEP:	6:PcI9+q2PqLTwi23oH+Tcwt7Uh2ghZIFUt82cZXJZmw+2cZX9VkwOqLTwi23oH+T8:Pp4v8wZYebIhHh2FUt82IJ/+2ID5TwZ0
MD5:	008D3D94141E4C4D2E89687329ED91E5
SHA1:	40D6D1F352641653A4D49AA6A64C411060DD0A8F
SHA-256:	81CAD6327EB627D0B8660E01FC7824F924FE06718F81777F169B4450805C7D9E
SHA-512:	096AF1660987A20EE61F9AF36DDB4324633A968DE867CE33E29FA18804A7B52CFB3CD0529C4CC16353BEBC9D30DB8FE06FE99FFE743EC1A67A9436654742B578
Malicious:	false
Preview:	2024/09/06-08:18:13.677 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/06-08:18:13.678 1db8 Recovering log #3.2024/09/06-08:18:13.678 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old~RF26bc0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.178131801134291
Encrypted:	false
SSDEEP:	6:PcI9+q2PqLTwi23oH+Tcwt7Uh2ghZIFUt82cZXJZmw+2cZX9VkwOqLTwi23oH+T8:Pp4v8wZYebIhHh2FUt82IJ/+2ID5TwZ0
MD5:	008D3D94141E4C4D2E89687329ED91E5
SHA1:	40D6D1F352641653A4D49AA6A64C411060DD0A8F
SHA-256:	81CAD6327EB627D0B8660E01FC7824F924FE06718F81777F169B4450805C7D9E
SHA-512:	096AF1660987A20EE61F9AF36DDB4324633A968DE867CE33E29FA18804A7B52CFB3CD0529C4CC16353BEBC9D30DB8FE06FE99FFE743EC1A67A9436654742B578
Malicious:	false
Preview:	2024/09/06-08:18:13.677 1db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/09/06-08:18:13.678 1db8 Recovering log #3.2024/09/06-08:18:13.678 1db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.18903959336303
Encrypted:	false
SSDEEP:	6:PcwHQyq2PqLTwi23oH+TcwtpIFUt82cwHG1Zmw+2c5QRkwOqLTwi23oH+Tcwta/o:Poyv8wZYebmFUt82o/+2fR5TwZYebaUJ
MD5:	E7A8448A67EF8BC1CA7D847D8976477C
SHA1:	AE86E6FCE7F863531698D595707C06DA2D75FA52
SHA-256:	5727F5A8CDE2B0354DB4C6E72963469E7C2D14825510E7A914B92858C276B8B1
SHA-512:	845A4F7F7EDC1DFEA8054465AC0C36CCBA1CBA8CA0C01A0D2F8E99A4B2165C9DA06E8B142197940D17FFD70369E038E3979483A832F60E00C042B193C83CDB9F
Malicious:	false
Preview:	2024/09/06-08:18:13.630 22e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/06-08:18:13.630 22e4 Recovering log #3.2024/09/06-08:18:13.639 22e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.18903959336303
Encrypted:	false
SSDEEP:	6:PcwHQyq2PqLTwi23oH+TcwtpIFUt82cwHG1Zmw+2c5QRkwOqLTwi23oH+Tcwta/o:Poyv8wZYebmFUt82o/+2fR5TwZYebaUJ
MD5:	E7A8448A67EF8BC1CA7D847D8976477C
SHA1:	AE86E6FCE7F863531698D595707C06DA2D75FA52
SHA-256:	5727F5A8CDE2B0354DB4C6E72963469E7C2D14825510E7A914B92858C276B8B1
SHA-512:	845A4F7F7EDC1DFEA8054465AC0C36CCBA1CBA8CA0C01A0D2F8E99A4B2165C9DA06E8B142197940D17FFD70369E038E3979483A832F60E00C042B193C83CDB9F
Malicious:	false
Preview:	2024/09/06-08:18:13.630 22e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/06-08:18:13.630 22e4 Recovering log #3.2024/09/06-08:18:13.639 22e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old~RF26bc0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.18903959336303
Encrypted:	false
SSDEEP:	6:PcwHQyq2PqLTwi23oH+TcwtpIFUt82cwHG1Zmw+2c5QRkwOqLTwi23oH+Tcwta/o:Poyv8wZYebmFUt82o/+2fR5TwZYebaUJ
MD5:	E7A8448A67EF8BC1CA7D847D8976477C
SHA1:	AE86E6FCE7F863531698D595707C06DA2D75FA52
SHA-256:	5727F5A8CDE2B0354DB4C6E72963469E7C2D14825510E7A914B92858C276B8B1
SHA-512:	845A4F7F7EDC1DFEA8054465AC0C36CCBA1CBA8CA0C01A0D2F8E99A4B2165C9DA06E8B142197940D17FFD70369E038E3979483A832F60E00C042B193C83CDB9F
Malicious:	false
Preview:	2024/09/06-08:18:13.630 22e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/09/06-08:18:13.630 22e4 Recovering log #3.2024/09/06-08:18:13.639 22e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.12304509444687
Encrypted:	false
SSDEEP:	384:KdM2qOB1nxCkuSAELyKOMq+8ETZKoxAX:Kvq+n0Z9ELyKOMq+8ET8cU
MD5:	618067FADC8C13BDB3DD9654D4165B8F
SHA1:	DCFE8A1D2F1DA5183A0A4AACDC199219057599FF
SHA-256:	7B5DA347DE12CEA36F73CD629E7E871CFB7B7F8F6DA64D55307BBE15D06DCBB5
SHA-512:	691A81A04B5E9FDF6CC9DCDB31EE947ABAE5B48BAF78792B770D5F222DCF87AD16E725CE0E6CB9A7304CC7B47E5A664667ACFBD55191F2A0011F1891B7D5F98B
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a8c36e52-4002-492f-b60d-44e1c16b7312.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	5.569051864382412
Encrypted:	false
SSDEEP:	768:rBkLBSWPQDfA/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8twrUrwadpFtuU:rBkLBSWPQDfA/u1jaROrNaRt/
MD5:	3E90564596C7837FB1460E16D9AE89CB
SHA1:	B3EAC16D4520A2D4DCC92B10B405F2C4B6858091
SHA-256:	AB6DDAE559A854DC4E2AAC4CEC9846631A38ADC5CAB53CD74D249157252EDFC6
SHA-512:	EF23A5026AEFAA64780006D682DE2F72A1D69200982C4567415AA898E3705E828605C9CDE37FAE7E96D503A0849684D9D60AEE59C87E7FFFAE2A236A760C935A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13370098693621031","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13370098693621031","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b2ef6605-7db7-45cf-b02b-5a1ae80e392a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 8, database pages 11, cookie 0x7, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.4108834313259155
Encrypted:	false
SSDEEP:	24:TSWUYP5/ZrK/AxH1Aj5sAFWZmasamfDsCBjy8e+ZcI5fc:TnUYVAKAFXX+CcEc
MD5:	8593795778EA3EC8221366AA2FBBA867
SHA1:	2F307D4925183EA13E7BE637CB93ECAF2BA9810A
SHA-256:	F3C17873660988454A5A403D047FCE88379D1FE8917A89C98E6EB940F8929C03
SHA-512:	CC86DD61ACEDA6F2927C4C23CBD6D426F2C8CD1DF65E342C76D07153ACBF801F9B297F8EF182097CBABBDE6A49C90AF0E7A38E49AB53DF3FD2EC2D5BC675099A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................?.P................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04998394447396411
Encrypted:	false
SSDEEP:	6:Gd0oTlZGd0oTlZXL9XCChslotGLNl0ml/XoQDeX:zoB9oBfpEjVl/XoQ
MD5:	21682FFE79EECBA59964C7CA71851683
SHA1:	C70D48838CB3D6260225DEC23685DBC1307B2B85
SHA-256:	69431C96FA7D33183AA8EF3FF7534501EE2ED2FC933F94AB92990A821158BE93
SHA-512:	924ED897B7B7E89312A44D9EFACC7360F07D854C3F51CF1AA9EB9D0421D125947D4B0D9B396766CB89D7BEB33B214E66D6C374231098A40784913C3EAC236CC6
Malicious:	false
Preview:	..-...........................}XF{.....h.1..\|1....-...........................}XF{.....h.1..\|1..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.2290254424532545
Encrypted:	false
SSDEEP:	6:PHhQtM+q2PqLTwi23oH+TcwtfrK+IFUt82HhQZvZmw+2HhQZiMVkwOqLTwi23oHK:Pm++v8wZYeb23FUt82mp/+2mdV5TwZYq
MD5:	219F305BB6A00F4857E137E25351ED6E
SHA1:	C4193EE0F7254AC050A8E632C415F3FA08E8BE75
SHA-256:	441AAFD287A3893B35A327A2EBDA22CE7CA9C3B8E17D372DEEB13077E11B7E9D
SHA-512:	850ECD44E436327739B4E5D4E31FA2272F18A70748D61F41BE5E329BA7738383C373CF9ED23140392ED31D852533F57BD872C12447F781C04A7FA4DE43548046
Malicious:	false
Preview:	2024/09/06-08:18:14.053 221c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/09/06-08:18:14.056 221c Recovering log #3.2024/09/06-08:18:14.056 221c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.2290254424532545
Encrypted:	false
SSDEEP:	6:PHhQtM+q2PqLTwi23oH+TcwtfrK+IFUt82HhQZvZmw+2HhQZiMVkwOqLTwi23oHK:Pm++v8wZYeb23FUt82mp/+2mdV5TwZYq
MD5:	219F305BB6A00F4857E137E25351ED6E
SHA1:	C4193EE0F7254AC050A8E632C415F3FA08E8BE75
SHA-256:	441AAFD287A3893B35A327A2EBDA22CE7CA9C3B8E17D372DEEB13077E11B7E9D
SHA-512:	850ECD44E436327739B4E5D4E31FA2272F18A70748D61F41BE5E329BA7738383C373CF9ED23140392ED31D852533F57BD872C12447F781C04A7FA4DE43548046
Malicious:	false
Preview:	2024/09/06-08:18:14.053 221c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/09/06-08:18:14.056 221c Recovering log #3.2024/09/06-08:18:14.056 221c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old~RF26c7b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.2290254424532545
Encrypted:	false
SSDEEP:	6:PHhQtM+q2PqLTwi23oH+TcwtfrK+IFUt82HhQZvZmw+2HhQZiMVkwOqLTwi23oHK:Pm++v8wZYeb23FUt82mp/+2mdV5TwZYq
MD5:	219F305BB6A00F4857E137E25351ED6E
SHA1:	C4193EE0F7254AC050A8E632C415F3FA08E8BE75
SHA-256:	441AAFD287A3893B35A327A2EBDA22CE7CA9C3B8E17D372DEEB13077E11B7E9D
SHA-512:	850ECD44E436327739B4E5D4E31FA2272F18A70748D61F41BE5E329BA7738383C373CF9ED23140392ED31D852533F57BD872C12447F781C04A7FA4DE43548046
Malicious:	false
Preview:	2024/09/06-08:18:14.053 221c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/09/06-08:18:14.056 221c Recovering log #3.2024/09/06-08:18:14.056 221c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.206726410847761
Encrypted:	false
SSDEEP:	6:PxlUSMM+q2PqLTwi23oH+TcwtfrzAdIFUt823lZmw+21gMVkwOqLTwi23oH+Tcwc:Pb+v8wZYeb9FUt823l/+23V5TwZYeb2J
MD5:	9D536AC6FAD4BF0AFE1F1857F60D3270
SHA1:	237260E8DB44A4426EE1B14088DEB31F87A7ADF0
SHA-256:	7D5ADF9302E7E180D4CB3EFC7C9320E24620FF06EB2D9AFD185660CBEBB82042
SHA-512:	8F52F434896FA9A92D57D5C610FD423745C5226532D08EEFC15B11B826BDE255558F385EF54C85196E105A80DADC8F49035640C5A97D4F51199F0C22FD3E6088
Malicious:	false
Preview:	2024/09/06-08:18:13.982 221c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/09/06-08:18:13.984 221c Recovering log #3.2024/09/06-08:18:13.986 221c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.206726410847761
Encrypted:	false
SSDEEP:	6:PxlUSMM+q2PqLTwi23oH+TcwtfrzAdIFUt823lZmw+21gMVkwOqLTwi23oH+Tcwc:Pb+v8wZYeb9FUt823l/+23V5TwZYeb2J
MD5:	9D536AC6FAD4BF0AFE1F1857F60D3270
SHA1:	237260E8DB44A4426EE1B14088DEB31F87A7ADF0
SHA-256:	7D5ADF9302E7E180D4CB3EFC7C9320E24620FF06EB2D9AFD185660CBEBB82042
SHA-512:	8F52F434896FA9A92D57D5C610FD423745C5226532D08EEFC15B11B826BDE255558F385EF54C85196E105A80DADC8F49035640C5A97D4F51199F0C22FD3E6088
Malicious:	false
Preview:	2024/09/06-08:18:13.982 221c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/09/06-08:18:13.984 221c Recovering log #3.2024/09/06-08:18:13.986 221c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old~RF26c6c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.206726410847761
Encrypted:	false
SSDEEP:	6:PxlUSMM+q2PqLTwi23oH+TcwtfrzAdIFUt823lZmw+21gMVkwOqLTwi23oH+Tcwc:Pb+v8wZYeb9FUt823l/+23V5TwZYeb2J
MD5:	9D536AC6FAD4BF0AFE1F1857F60D3270
SHA1:	237260E8DB44A4426EE1B14088DEB31F87A7ADF0
SHA-256:	7D5ADF9302E7E180D4CB3EFC7C9320E24620FF06EB2D9AFD185660CBEBB82042
SHA-512:	8F52F434896FA9A92D57D5C610FD423745C5226532D08EEFC15B11B826BDE255558F385EF54C85196E105A80DADC8F49035640C5A97D4F51199F0C22FD3E6088
Malicious:	false
Preview:	2024/09/06-08:18:13.982 221c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/09/06-08:18:13.984 221c Recovering log #3.2024/09/06-08:18:13.986 221c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101680411106963
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLCBS2qX7bptPHgorQXdbiR3oM:z/0+zI7ynLkS205tP0Xdbe3
MD5:	17F40A6607EB2436F0A052CC6293457A
SHA1:	5CF84A56AACE509E06B46FF60B8DC6D81CDFA3B5
SHA-256:	4BA71BA8F71959430AB01470745200D6583A03F813683A8E202F5A70EABA58F8
SHA-512:	1BD379281C42B5E128ED7FFACA37C2098C4D2D7793F271C9D0856526CDBADCEFEC630C4AD51585840DC749B51BDC30E9258BF34C17A7B80861431E49BEF65A7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24b95.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101680411106963
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLCBS2qX7bptPHgorQXdbiR3oM:z/0+zI7ynLkS205tP0Xdbe3
MD5:	17F40A6607EB2436F0A052CC6293457A
SHA1:	5CF84A56AACE509E06B46FF60B8DC6D81CDFA3B5
SHA-256:	4BA71BA8F71959430AB01470745200D6583A03F813683A8E202F5A70EABA58F8
SHA-512:	1BD379281C42B5E128ED7FFACA37C2098C4D2D7793F271C9D0856526CDBADCEFEC630C4AD51585840DC749B51BDC30E9258BF34C17A7B80861431E49BEF65A7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24ced.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101680411106963
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLCBS2qX7bptPHgorQXdbiR3oM:z/0+zI7ynLkS205tP0Xdbe3
MD5:	17F40A6607EB2436F0A052CC6293457A
SHA1:	5CF84A56AACE509E06B46FF60B8DC6D81CDFA3B5
SHA-256:	4BA71BA8F71959430AB01470745200D6583A03F813683A8E202F5A70EABA58F8
SHA-512:	1BD379281C42B5E128ED7FFACA37C2098C4D2D7793F271C9D0856526CDBADCEFEC630C4AD51585840DC749B51BDC30E9258BF34C17A7B80861431E49BEF65A7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24da9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101680411106963
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLCBS2qX7bptPHgorQXdbiR3oM:z/0+zI7ynLkS205tP0Xdbe3
MD5:	17F40A6607EB2436F0A052CC6293457A
SHA1:	5CF84A56AACE509E06B46FF60B8DC6D81CDFA3B5
SHA-256:	4BA71BA8F71959430AB01470745200D6583A03F813683A8E202F5A70EABA58F8
SHA-512:	1BD379281C42B5E128ED7FFACA37C2098C4D2D7793F271C9D0856526CDBADCEFEC630C4AD51585840DC749B51BDC30E9258BF34C17A7B80861431E49BEF65A7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF26c2d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101680411106963
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLCBS2qX7bptPHgorQXdbiR3oM:z/0+zI7ynLkS205tP0Xdbe3
MD5:	17F40A6607EB2436F0A052CC6293457A
SHA1:	5CF84A56AACE509E06B46FF60B8DC6D81CDFA3B5
SHA-256:	4BA71BA8F71959430AB01470745200D6583A03F813683A8E202F5A70EABA58F8
SHA-512:	1BD379281C42B5E128ED7FFACA37C2098C4D2D7793F271C9D0856526CDBADCEFEC630C4AD51585840DC749B51BDC30E9258BF34C17A7B80861431E49BEF65A7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF26c8b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101680411106963
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLCBS2qX7bptPHgorQXdbiR3oM:z/0+zI7ynLkS205tP0Xdbe3
MD5:	17F40A6607EB2436F0A052CC6293457A
SHA1:	5CF84A56AACE509E06B46FF60B8DC6D81CDFA3B5
SHA-256:	4BA71BA8F71959430AB01470745200D6583A03F813683A8E202F5A70EABA58F8
SHA-512:	1BD379281C42B5E128ED7FFACA37C2098C4D2D7793F271C9D0856526CDBADCEFEC630C4AD51585840DC749B51BDC30E9258BF34C17A7B80861431E49BEF65A7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF26c9b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101680411106963
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynLCBS2qX7bptPHgorQXdbiR3oM:z/0+zI7ynLkS205tP0Xdbe3
MD5:	17F40A6607EB2436F0A052CC6293457A
SHA1:	5CF84A56AACE509E06B46FF60B8DC6D81CDFA3B5
SHA-256:	4BA71BA8F71959430AB01470745200D6583A03F813683A8E202F5A70EABA58F8
SHA-512:	1BD379281C42B5E128ED7FFACA37C2098C4D2D7793F271C9D0856526CDBADCEFEC630C4AD51585840DC749B51BDC30E9258BF34C17A7B80861431E49BEF65A7F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0018164538716206493
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlqv9l/:/M/xT02zBll/
MD5:	564CC97517696160E516CEE81436CCE0
SHA1:	150BC3E4A404AFCCC7D3FB8CFECE32F6F8EE64E4
SHA-256:	65EA4BCAEF39FCF77B730FF3FB2DB50B99948B5C8D95559AEE21257555C27C9E
SHA-512:	BB903AB5338543192DFE38C4D524910F682413898A27E97B3CEC02203BBFF6DEFA7FBD91AF0BE8EE8FEE01EC6827959F6AA2952E5ABC016A43670B2C58A298A4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cdac26ba-a134-4ac9-89ea-7b7396ce80a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58953
Entropy (8bit):	6.104465376228589
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yOjCBS2qX7bxwgorQXdbiR3oM:z/0+zI7yOjkS20HXdbe3
MD5:	05874FCAA4BE191F87DB0F7E61BFD9D7
SHA1:	D491135B1DA4199005ECAEF0FBA8047FF44BCEDD
SHA-256:	6B1319E40FAD86F8CB89D5C7B0EDDF0F2CC150972017393DAAEB92F8BA0F1A14
SHA-512:	17DC07C745E27937D9A107C1B69F09783AFF52750A9A2FFE7EFBA1C13D148C67BC273A0ADCC14B78BECE7207B68A1FD4195E8CBB2B3CE47EF0DF979FE2736AED
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e8bd081d-ee77-477d-8156-3d73a04c60be.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58953
Entropy (8bit):	6.104685877592219
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yOgCBS2qX7bewgorQXdbiR3oM:z/0+zI7yOgkS20AXdbe3
MD5:	D4C23B81F70F8DE2232F77D37EFDE4D8
SHA1:	2F8B82D820B9B291C0CA7C19C17D9F1BD3183747
SHA-256:	B89319673D283E8C84588AD7AC7E81759236B0E053DD8E2CAAA9DD3A6621D825
SHA-512:	8D831780FCC242F9F63DE763737190D095082ECFF9417BABDF29C0C75431FC0A89E3645562F827CFA2007F92FDA2596D98680A7444F6CDC92C6C05901C6A6134
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8419017983259667
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxDxl9Il8uO08e2n5PqobBu+/bpT0u3Nd1rc:mSYU0Un55jbpAkW
MD5:	E17D34B28D765C85482772EB2A9756FF
SHA1:	D756B1013DC0E8BECC4C49DCAABB62BEC3D0FD3E
SHA-256:	D192AB9AF1E1F17E38BB4195F654A66CBDD7A387E7ABC6509094B9349A3ED5A0
SHA-512:	89C85CEEA44FD4F82EAD2B8D462793CBE61388BC48D61F7F854CF1DA136A8382030ED85387FE5C276D25C66185D21BBF4A470E1253CFED86EF5D7833DC2A762D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.B.2.B.M.V.8.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.W.O.X.P.O.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.002525864267349
Encrypted:	false
SSDEEP:	96:wY3t04h3Saiul0ZnTwzHP7JHZ/bS3xXrt3+k:wwK4kaXK4HP1H2xXrT
MD5:	EF92F35148D95DF3321EA7ECAF3A38C3
SHA1:	3AA12E7F1E9644883F1C5A7044538C0264CC076B
SHA-256:	3AFB5D2EC761DF3964FE0DB350CFD5DBC382E5A66A7C851ABC744D720A6C576F
SHA-512:	D917ABE2994D7855DE4F50D4189B32D0B8FF8F4CF8FEC84329C627F6611A898A512B74D42DE1B61AD6605064066D913501FC535509DAA351A2B76CE49810B21C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".t.e.V.Z.F.1.c.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.W.O.X.P.O.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1190
Entropy (8bit):	5.359519432606866
Encrypted:	false
SSDEEP:	24:YDG5LwRD0s/Up5fP1x5fn7Zu0QRWE5fR+nh0Qut5fxjK0mNo0h:YDG5LOD0s8p5nX5/o0KWE5JC0Nt5pO0g
MD5:	8CAD9AC5BC451E5CD18221068C79FD7A
SHA1:	C0A1E5205F37318AC8685154DA862A47B2DF6877
SHA-256:	42F7853A35D617117E1B4660B9E236508CE43B02AFF8F74987D3E6D64B727690
SHA-512:	73EC61B6DBDBA2AA9D873468BEB9024F866753139048AF2E786C9A4D42E3CA8DC6AD516E9982F737C58D6C2C90113493DB97CB2FC588FB084C8588812C767014
Malicious:	false
Preview:	{"logTime": "1005/085948", "correlationVector":"8sNXFnC9i2+S99lAzDH6Rq","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/085948", "correlationVector":"81A02D7FC86E45EDA6CBCA8671A98AFF","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/085948", "correlationVector":"NiTqUUpDli2IJjzrRApLSF","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091044", "correlationVector":"4hXMqVe30Bl32fn1+6AOy1","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091053", "correlationVector":"D7BB119EE9F4429BBF8B8E46242DB5E9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/091235", "correlationVector":"Wk5x1on3JpNq4FXPG6U9B5","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091235", "correlationVector":"EC448E7330FA4F5EA1E7898FDD3F2CB6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/091436", "correlationVector":"Ltc1GKjZ6R4P7ed5oiO6YB","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091437", "correlationVector":"A569DB44

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\70O254K776S9OA95WF7M.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.511644555385777
Encrypted:	false
SSDEEP:	48:WEN8dOtgTvwsJBrWzBdLXuHAkDp82A5vXdOtgTNwsJBrWzngdLXuHAk+21:qTC3ugkDrYT8nIugkz
MD5:	10EC37AA3E22E00EF1226DCC3AED4F14
SHA1:	08161664DA16F7E33A5CAEFAF504DB667D439131
SHA-256:	F272E7F50B83C3C2354B72E6ECF34D888AB1024E0668B9AA6DC0CD7B60E7ECBE
SHA-512:	AD15C39ABBB0CCB4D8D55FB7258DB2A1B605C26DF360476D8306F589ABEF462566AF4A5A1E4E4E0B3E3AED61D66F963CA6AEDDFB085055F91FAE2F241CD3CFD1
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......V....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....EW.J..PROGRA~2.........O.IEW.J....................V.......u.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....EW.J..MICROS~1..D......(Ux.&Y=b..............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.EWuG...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.&Y<b..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.&Y<b....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........M-[......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\875a60a09683c344.customDesusertions-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.511644555385777
Encrypted:	false
SSDEEP:	48:WEN8dOtgTvwsJBrWzBdLXuHAkDp82A5vXdOtgTNwsJBrWzngdLXuHAk+21:qTC3ugkDrYT8nIugkz
MD5:	10EC37AA3E22E00EF1226DCC3AED4F14
SHA1:	08161664DA16F7E33A5CAEFAF504DB667D439131
SHA-256:	F272E7F50B83C3C2354B72E6ECF34D888AB1024E0668B9AA6DC0CD7B60E7ECBE
SHA-512:	AD15C39ABBB0CCB4D8D55FB7258DB2A1B605C26DF360476D8306F589ABEF462566AF4A5A1E4E4E0B3E3AED61D66F963CA6AEDDFB085055F91FAE2F241CD3CFD1
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......V....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....EW.J..PROGRA~2.........O.IEW.J....................V.......u.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....EW.J..MICROS~1..D......(Ux.&Y=b..............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.EWuG...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.&Y<b..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.&Y<b....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........M-[......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\I937O5E65X7TZ6HRV2LS.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5083497600201627
Encrypted:	false
SSDEEP:	48:WE5vXdOtgTNwsJBrWzBdLXuHAkDp82A5vXdOtgTNwsJBrWzngdLXuHAk+21:LT83ugkDrYT8nIugkz
MD5:	8F1D53F108B39997087A8E7CF459C7AF
SHA1:	6B979A8D7E063AD49AE5E8C15CFEB6709E6FB2E0
SHA-256:	65136923E18A7E0863D4851E99130F939CAC8B3B2B4CE2F1BF46D78BCB287D76
SHA-512:	1FC550525D052EC92AEEDD694F23C9A55C44438CD3CC202A21880D953D2171B9D0D9995B6FDDFCA729C99300B983048BC2B3AEFCE04AC86926F3390470B1058D
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......V....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....&Y:b..PROGRA~2.........O.I&Y:b....................V.....V...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....EW.J..MICROS~1..D......(Ux.&Y=b..............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.&YAb...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.&Y<b..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.&Y<b....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........M-[......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\ccba5a5986c77e43.customDesusertions-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5083497600201627
Encrypted:	false
SSDEEP:	48:WE5vXdOtgTNwsJBrWzBdLXuHAkDp82A5vXdOtgTNwsJBrWzngdLXuHAk+21:LT83ugkDrYT8nIugkz
MD5:	8F1D53F108B39997087A8E7CF459C7AF
SHA1:	6B979A8D7E063AD49AE5E8C15CFEB6709E6FB2E0
SHA-256:	65136923E18A7E0863D4851E99130F939CAC8B3B2B4CE2F1BF46D78BCB287D76
SHA-512:	1FC550525D052EC92AEEDD694F23C9A55C44438CD3CC202A21880D953D2171B9D0D9995B6FDDFCA729C99300B983048BC2B3AEFCE04AC86926F3390470B1058D
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K......V....?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....&Y:b..PROGRA~2.........O.I&Y:b....................V.....V...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....EW.J..MICROS~1..D......(Ux.&Y=b..............................M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.&YAb...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.&Y<b..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.&Y<b....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........M-[......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.579737692075065
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	917'504 bytes
MD5:	4e47b9e5520b1a3bd0c8f59ff741bef9
SHA1:	a0d0fb46dac91c6ac783fe35a6cd5c44f0d10265
SHA256:	7662d44473b4c370596a961a962dc7327f6acf03eb69d9cbcda361ffd159742d
SHA512:	477a61baf7a657fd4bb6f1fc525263c2e596e939792a442d0e89c7eee336f9b0749cc8d642c726e51fefbb8ba52cf35ea0106bee67e8b125ad6f476d1efe64b5
SSDEEP:	12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacT6:SqDEvCTbMWu7rQYlBQcBiT6rprG8as6
TLSH:	CD159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66DAF0E0 [Fri Sep 6 12:09:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F4020C94643h
jmp 00007F4020C93F4Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F4020C9412Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F4020C940FAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F4020C96CEDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F4020C96D38h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F4020C96D21h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x95c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xde000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x95c8	0x9600	a0481118718592a61122eca3d1456c90	False	0.28692708333333333	data	5.165246132927471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xde000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x890	data			1.0050182481751824
RT_GROUP_ICON	0xdd048	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xdd0c0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xdd0d4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xdd0e8	0x14	data	English	Great Britain	1.25
RT_VERSION	0xdd0fc	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xdd1d8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 6, 2024 14:17:51.068495989 CEST	49677	443	192.168.2.9	20.189.173.11
Sep 6, 2024 14:17:51.380474091 CEST	49677	443	192.168.2.9	20.189.173.11
Sep 6, 2024 14:17:51.989778042 CEST	49677	443	192.168.2.9	20.189.173.11
Sep 6, 2024 14:17:52.005435944 CEST	49673	443	192.168.2.9	204.79.197.203
Sep 6, 2024 14:17:52.036655903 CEST	49676	443	192.168.2.9	23.206.229.209
Sep 6, 2024 14:17:52.036818981 CEST	49675	443	192.168.2.9	23.206.229.209
Sep 6, 2024 14:17:52.161664963 CEST	49674	443	192.168.2.9	23.206.229.209
Sep 6, 2024 14:17:53.192899942 CEST	49677	443	192.168.2.9	20.189.173.11
Sep 6, 2024 14:17:55.599163055 CEST	49677	443	192.168.2.9	20.189.173.11
Sep 6, 2024 14:17:59.617960930 CEST	49708	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:17:59.618010044 CEST	443	49708	52.123.243.83	192.168.2.9
Sep 6, 2024 14:17:59.618068933 CEST	49708	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:17:59.658514977 CEST	49708	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:17:59.658550978 CEST	443	49708	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:00.460824013 CEST	49677	443	192.168.2.9	20.189.173.11
Sep 6, 2024 14:18:00.472810984 CEST	443	49708	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:00.473161936 CEST	49708	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:00.473186016 CEST	443	49708	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:00.474199057 CEST	443	49708	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:00.474253893 CEST	49708	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:00.475562096 CEST	49708	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:00.475625992 CEST	443	49708	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:00.475838900 CEST	49708	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:00.475848913 CEST	443	49708	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:00.523219109 CEST	49708	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:00.853387117 CEST	443	49708	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:00.853490114 CEST	443	49708	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:00.853545904 CEST	49708	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:00.854280949 CEST	49708	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:00.854309082 CEST	443	49708	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:01.664226055 CEST	49673	443	192.168.2.9	204.79.197.203
Sep 6, 2024 14:18:01.664239883 CEST	49676	443	192.168.2.9	23.206.229.209
Sep 6, 2024 14:18:01.664319038 CEST	49675	443	192.168.2.9	23.206.229.209
Sep 6, 2024 14:18:01.857017994 CEST	49718	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:01.857053041 CEST	443	49718	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:01.857193947 CEST	49718	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:01.857589960 CEST	49718	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:01.857603073 CEST	443	49718	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:01.863240957 CEST	49674	443	192.168.2.9	23.206.229.209
Sep 6, 2024 14:18:02.003839970 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:02.003901958 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:02.003993988 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:02.005490065 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:02.005516052 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:02.592681885 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:02.592716932 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:02.592799902 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:02.593839884 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:02.593853951 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:02.643780947 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:02.643863916 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:02.647706032 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:02.647718906 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:02.647989035 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:02.665786028 CEST	443	49718	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.666193008 CEST	49718	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.666219950 CEST	443	49718	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.666554928 CEST	443	49718	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.666912079 CEST	49718	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.666974068 CEST	443	49718	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.689023972 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:02.711271048 CEST	49718	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.732501030 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:02.924875021 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:02.924973011 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:02.925017118 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:02.926003933 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:02.926028967 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:02.926043034 CEST	49721	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:02.926048994 CEST	443	49721	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:02.992937088 CEST	49725	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:02.992983103 CEST	443	49725	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:02.993069887 CEST	49725	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:02.993377924 CEST	49725	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:02.993393898 CEST	443	49725	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:03.075826883 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.075871944 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.075952053 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.076318026 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.076333046 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.232361078 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.232584000 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.232595921 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.233850956 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.233907938 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.234980106 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.235094070 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.235192060 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.235204935 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.288527012 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.334945917 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.334971905 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.334980011 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.335004091 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.335019112 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.335026026 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.335045099 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.335063934 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.335082054 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.335124969 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.420620918 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.420648098 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.420713902 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.420730114 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.420773029 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.422702074 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.422727108 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.422782898 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.422791004 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.422832966 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.429768085 CEST	443	49704	23.206.229.209	192.168.2.9
Sep 6, 2024 14:18:03.429892063 CEST	49704	443	192.168.2.9	23.206.229.209
Sep 6, 2024 14:18:03.507422924 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.507448912 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.507486105 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.507500887 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.507514954 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.507529020 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.507550955 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.507558107 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.507575035 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.507607937 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.507611036 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.507667065 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.508637905 CEST	49724	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.508654118 CEST	443	49724	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.650007010 CEST	443	49725	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:03.650096893 CEST	49725	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:03.651470900 CEST	49725	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:03.651480913 CEST	443	49725	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:03.651748896 CEST	443	49725	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:03.652908087 CEST	49725	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:03.700495005 CEST	443	49725	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:03.712079048 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.712388039 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.712419033 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.713517904 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.713591099 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.714099884 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.714173079 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.714281082 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.757255077 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.757287979 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.786626101 CEST	49733	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:03.786676884 CEST	443	49733	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:03.786744118 CEST	49733	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:03.786943913 CEST	49733	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:03.786955118 CEST	443	49733	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:03.788441896 CEST	49734	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:03.788472891 CEST	443	49734	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:03.788630009 CEST	49734	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:03.788939953 CEST	49734	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:03.788949966 CEST	443	49734	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:03.791749954 CEST	49735	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.792001009 CEST	49736	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:03.792017937 CEST	443	49736	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:03.792084932 CEST	49736	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:03.792218924 CEST	49736	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:03.792237997 CEST	443	49736	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:03.796823025 CEST	53	49735	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.796884060 CEST	49735	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.797003984 CEST	49735	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.797015905 CEST	49735	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.797056913 CEST	49735	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.797344923 CEST	49737	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:03.797369957 CEST	443	49737	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:03.797435999 CEST	49737	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:03.797591925 CEST	49737	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:03.797604084 CEST	443	49737	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:03.801918983 CEST	53	49735	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.801934958 CEST	53	49735	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.804124117 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.812942982 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.812968016 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.812982082 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.812999964 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.813010931 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.813024044 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.813033104 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.813057899 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.813070059 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.813082933 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.813093901 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.813126087 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.829262018 CEST	49726	443	192.168.2.9	13.107.246.60
Sep 6, 2024 14:18:03.829288006 CEST	443	49726	13.107.246.60	192.168.2.9
Sep 6, 2024 14:18:03.836097956 CEST	49738	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:03.836144924 CEST	443	49738	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:03.836210966 CEST	49738	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:03.836990118 CEST	49738	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:03.837003946 CEST	443	49738	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:03.842988014 CEST	53	49735	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.930207968 CEST	443	49725	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:03.930282116 CEST	443	49725	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:03.930463076 CEST	49725	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:03.931058884 CEST	49725	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:03.931078911 CEST	443	49725	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:03.931091070 CEST	49725	443	192.168.2.9	184.28.90.27
Sep 6, 2024 14:18:03.931097031 CEST	443	49725	184.28.90.27	192.168.2.9
Sep 6, 2024 14:18:04.189312935 CEST	53	49735	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:04.189383984 CEST	49735	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:04.256557941 CEST	443	49734	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.257289886 CEST	49734	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.257302046 CEST	443	49734	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.258328915 CEST	443	49734	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.258393049 CEST	49734	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.259572983 CEST	49734	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.259572983 CEST	49734	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.259624004 CEST	443	49734	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.271980047 CEST	443	49733	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.272293091 CEST	49733	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.272320986 CEST	443	49733	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.273360014 CEST	443	49733	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.273417950 CEST	49733	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.274590969 CEST	49733	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.274646044 CEST	443	49733	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.274833918 CEST	49733	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.274837971 CEST	443	49733	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.293451071 CEST	443	49738	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.293699026 CEST	49738	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.293718100 CEST	443	49738	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.294555902 CEST	443	49737	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.294858932 CEST	443	49738	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.295046091 CEST	49738	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.295413017 CEST	49737	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.295420885 CEST	443	49737	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.295785904 CEST	49738	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.295981884 CEST	49738	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.296020031 CEST	443	49738	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.297672987 CEST	443	49737	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.297734022 CEST	49737	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.298737049 CEST	49737	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.298790932 CEST	443	49737	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.298805952 CEST	443	49736	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.298852921 CEST	49737	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.298861027 CEST	443	49737	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.299273014 CEST	49736	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.299278975 CEST	443	49736	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.300331116 CEST	443	49736	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.300384045 CEST	49736	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.301299095 CEST	49736	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.301363945 CEST	443	49736	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.301481009 CEST	49736	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.306919098 CEST	49734	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.306927919 CEST	443	49734	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.322482109 CEST	49733	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.338027000 CEST	49738	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.338042974 CEST	443	49738	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.348494053 CEST	443	49736	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.353642941 CEST	49737	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.353661060 CEST	49736	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.353677034 CEST	443	49736	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.353741884 CEST	49734	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.384361029 CEST	49738	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.388144016 CEST	443	49734	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.388217926 CEST	443	49734	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.388281107 CEST	49734	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.388457060 CEST	49734	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.388474941 CEST	443	49734	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.399873018 CEST	49736	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.412539959 CEST	443	49733	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.412614107 CEST	443	49733	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.413178921 CEST	49733	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.413258076 CEST	49733	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.413274050 CEST	443	49733	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.413621902 CEST	443	49737	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.413685083 CEST	443	49737	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.413738966 CEST	49737	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.413927078 CEST	49737	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.413930893 CEST	443	49737	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.432172060 CEST	443	49738	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.432241917 CEST	443	49738	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:04.432307959 CEST	49738	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.433357954 CEST	443	49736	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.433418989 CEST	443	49736	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.433723927 CEST	49736	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.438082933 CEST	49736	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:04.438097954 CEST	443	49736	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:04.438340902 CEST	49738	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:04.438345909 CEST	443	49738	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:05.400351048 CEST	49739	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.400394917 CEST	443	49739	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.400486946 CEST	49739	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.400646925 CEST	49740	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.400681973 CEST	443	49740	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.400726080 CEST	49740	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.400913954 CEST	49739	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.400934935 CEST	443	49739	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.401113033 CEST	49740	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.401120901 CEST	443	49740	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.858716011 CEST	443	49739	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.859162092 CEST	49739	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.859186888 CEST	443	49739	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.859505892 CEST	443	49739	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.859803915 CEST	49741	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:05.859836102 CEST	443	49741	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:05.859891891 CEST	49741	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:05.860496998 CEST	49739	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.860565901 CEST	443	49739	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.860915899 CEST	49741	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:05.860924959 CEST	443	49741	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:05.880532980 CEST	49742	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:05.880547047 CEST	443	49742	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:05.880594969 CEST	49742	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:05.881489992 CEST	49742	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:05.881496906 CEST	443	49742	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:05.887958050 CEST	443	49740	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.888477087 CEST	49740	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.888500929 CEST	443	49740	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.888849974 CEST	443	49740	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.889206886 CEST	49740	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.889262915 CEST	443	49740	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.914844036 CEST	49739	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.932111979 CEST	49740	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:06.264837980 CEST	49743	443	192.168.2.9	142.250.81.228
Sep 6, 2024 14:18:06.264897108 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.264961958 CEST	49743	443	192.168.2.9	142.250.81.228
Sep 6, 2024 14:18:06.265510082 CEST	49743	443	192.168.2.9	142.250.81.228
Sep 6, 2024 14:18:06.265530109 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.345279932 CEST	443	49742	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.345590115 CEST	49742	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.345614910 CEST	443	49742	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.346021891 CEST	443	49742	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.346153975 CEST	49742	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.346781969 CEST	443	49742	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.346951008 CEST	49742	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.347918987 CEST	443	49741	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.348743916 CEST	49741	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.348767996 CEST	443	49741	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.349153996 CEST	443	49741	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.349270105 CEST	49741	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.349862099 CEST	443	49741	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.349975109 CEST	49741	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.368726969 CEST	49742	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.368726969 CEST	49741	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.368891001 CEST	443	49741	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.368896961 CEST	443	49742	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.369615078 CEST	49742	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.369615078 CEST	49741	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.369641066 CEST	443	49742	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.369657993 CEST	443	49741	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.416598082 CEST	49742	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.416599035 CEST	49741	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.476221085 CEST	443	49742	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.476382971 CEST	443	49742	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.476588011 CEST	49742	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.481211901 CEST	49742	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.481241941 CEST	443	49742	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.482386112 CEST	443	49741	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.482467890 CEST	443	49741	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.482763052 CEST	49741	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.486197948 CEST	49741	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.486219883 CEST	443	49741	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.732053995 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.732722998 CEST	49743	443	192.168.2.9	142.250.81.228
Sep 6, 2024 14:18:06.732764959 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.733825922 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.733947992 CEST	49743	443	192.168.2.9	142.250.81.228
Sep 6, 2024 14:18:06.734975100 CEST	49743	443	192.168.2.9	142.250.81.228
Sep 6, 2024 14:18:06.735053062 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.735208035 CEST	49743	443	192.168.2.9	142.250.81.228
Sep 6, 2024 14:18:06.735229015 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.789423943 CEST	49743	443	192.168.2.9	142.250.81.228
Sep 6, 2024 14:18:06.792467117 CEST	49744	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.792516947 CEST	443	49744	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.792922974 CEST	49745	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.792962074 CEST	443	49745	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.792989969 CEST	49744	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.793189049 CEST	49744	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.793194056 CEST	49745	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.793203115 CEST	443	49744	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.793373108 CEST	49745	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.793394089 CEST	443	49745	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.832000971 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.832052946 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.832115889 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.832151890 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.832178116 CEST	49743	443	192.168.2.9	142.250.81.228
Sep 6, 2024 14:18:06.832204103 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.832228899 CEST	49743	443	192.168.2.9	142.250.81.228
Sep 6, 2024 14:18:06.832401991 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:06.832627058 CEST	49743	443	192.168.2.9	142.250.81.228
Sep 6, 2024 14:18:06.833761930 CEST	49743	443	192.168.2.9	142.250.81.228
Sep 6, 2024 14:18:06.833779097 CEST	443	49743	142.250.81.228	192.168.2.9
Sep 6, 2024 14:18:07.252399921 CEST	443	49744	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.252751112 CEST	49744	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.252778053 CEST	443	49744	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.253314018 CEST	443	49744	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.253391027 CEST	49744	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.254036903 CEST	443	49744	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.254089117 CEST	49744	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.254350901 CEST	49744	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.254424095 CEST	443	49744	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.259569883 CEST	443	49745	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.259804010 CEST	49745	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.259819984 CEST	443	49745	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.260165930 CEST	443	49745	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.260230064 CEST	49745	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.260895014 CEST	443	49745	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.260952950 CEST	49745	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.261174917 CEST	49745	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.261229992 CEST	443	49745	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.304651022 CEST	49744	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.304675102 CEST	443	49744	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.304703951 CEST	49745	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.304723978 CEST	443	49745	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.351557016 CEST	49744	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.351613998 CEST	49745	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:10.070421934 CEST	49677	443	192.168.2.9	20.189.173.11
Sep 6, 2024 14:18:12.559639931 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:12.559689999 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:12.559797049 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:12.561280966 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:12.561294079 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.258285046 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.258358955 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:13.261430025 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:13.261451960 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.261708975 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.304498911 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:13.513449907 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:13.556493998 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.742332935 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.742357969 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.742366076 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.742374897 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.742399931 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.742400885 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:13.742427111 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.742440939 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.742446899 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:13.742459059 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:13.742475033 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:13.742505074 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:13.742510080 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.743031025 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:13.743074894 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:13.757580996 CEST	49746	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:13.757601023 CEST	443	49746	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:20.775713921 CEST	443	49739	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:20.775794029 CEST	443	49739	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:20.775871992 CEST	49739	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:20.791440010 CEST	443	49740	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:20.791517019 CEST	443	49740	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:20.791682959 CEST	49740	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:47.679747105 CEST	49718	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:47.679773092 CEST	443	49718	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:49.523530960 CEST	49705	80	192.168.2.9	199.232.210.172
Sep 6, 2024 14:18:49.529405117 CEST	80	49705	199.232.210.172	192.168.2.9
Sep 6, 2024 14:18:49.529524088 CEST	49705	80	192.168.2.9	199.232.210.172
Sep 6, 2024 14:18:52.087769985 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:52.087815046 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:52.087887049 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:52.088567972 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:52.088584900 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:52.304968119 CEST	49745	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:52.304970026 CEST	49744	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:52.304991007 CEST	443	49745	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:52.305001020 CEST	443	49744	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:52.772939920 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:52.773019075 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:52.775018930 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:52.775027037 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:52.775259972 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:52.776513100 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:52.824498892 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:53.052967072 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:53.052989006 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:53.053003073 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:53.053245068 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:53.053312063 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:53.053364038 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:53.053668022 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:53.053715944 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:53.053734064 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:53.053747892 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:53.053775072 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:53.053776979 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:53.053829908 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:53.058468103 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:53.058497906 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:53.058509111 CEST	49748	443	192.168.2.9	13.85.23.86
Sep 6, 2024 14:18:53.058515072 CEST	443	49748	13.85.23.86	192.168.2.9
Sep 6, 2024 14:18:58.620218992 CEST	49749	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.620266914 CEST	443	49749	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.620336056 CEST	49749	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.620513916 CEST	49750	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.620522022 CEST	443	49750	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.620570898 CEST	49750	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.620722055 CEST	49749	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.620737076 CEST	443	49749	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.620839119 CEST	49750	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.620847940 CEST	443	49750	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:59.081557989 CEST	443	49750	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:59.082139015 CEST	49750	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:59.082160950 CEST	443	49750	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:59.082487106 CEST	443	49750	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:59.082819939 CEST	49750	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:59.082871914 CEST	443	49750	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:59.095103025 CEST	443	49749	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:59.095330000 CEST	49749	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:59.095349073 CEST	443	49749	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:59.095659018 CEST	443	49749	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:59.095912933 CEST	49749	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:59.095967054 CEST	443	49749	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:59.133213043 CEST	49750	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:59.148840904 CEST	49749	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:19:05.789513111 CEST	49739	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:05.789547920 CEST	443	49739	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:05.804742098 CEST	49740	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:05.804773092 CEST	443	49740	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:13.991940022 CEST	443	49750	172.64.41.3	192.168.2.9
Sep 6, 2024 14:19:13.992022038 CEST	443	49750	172.64.41.3	192.168.2.9
Sep 6, 2024 14:19:13.992122889 CEST	49750	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:19:14.001463890 CEST	443	49749	172.64.41.3	192.168.2.9
Sep 6, 2024 14:19:14.001528978 CEST	443	49749	172.64.41.3	192.168.2.9
Sep 6, 2024 14:19:14.001683950 CEST	49749	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:19:32.680205107 CEST	49718	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:19:32.680224895 CEST	443	49718	52.123.243.83	192.168.2.9
Sep 6, 2024 14:19:35.743967056 CEST	49750	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:19:35.744010925 CEST	443	49750	172.64.41.3	192.168.2.9
Sep 6, 2024 14:19:35.744024992 CEST	49749	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:19:35.744030952 CEST	443	49749	172.64.41.3	192.168.2.9
Sep 6, 2024 14:19:35.744056940 CEST	49718	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:19:35.744201899 CEST	443	49718	52.123.243.83	192.168.2.9
Sep 6, 2024 14:19:35.744259119 CEST	49718	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:19:37.305182934 CEST	49744	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:19:37.305183887 CEST	49745	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:19:37.305217981 CEST	443	49745	142.251.41.14	192.168.2.9
Sep 6, 2024 14:19:37.305229902 CEST	443	49744	142.251.41.14	192.168.2.9
Sep 6, 2024 14:19:50.790276051 CEST	49739	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:50.790308952 CEST	443	49739	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:50.806368113 CEST	49740	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:50.806411028 CEST	443	49740	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:00.719866991 CEST	49753	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:00.719918966 CEST	443	49753	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:00.719991922 CEST	49753	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:00.720093966 CEST	49754	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:00.720101118 CEST	443	49754	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:00.720146894 CEST	49754	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:00.720288038 CEST	49753	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:00.720299006 CEST	443	49753	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:00.720429897 CEST	49754	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:00.720438957 CEST	443	49754	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.172511101 CEST	443	49754	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.178493977 CEST	49754	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.178524971 CEST	443	49754	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.178909063 CEST	443	49754	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.180212021 CEST	49754	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.180286884 CEST	443	49754	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.202248096 CEST	443	49753	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.202656031 CEST	49753	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.202670097 CEST	443	49753	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.202994108 CEST	443	49753	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.203915119 CEST	49753	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.203972101 CEST	443	49753	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.227482080 CEST	49754	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.258732080 CEST	49753	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.280250072 CEST	49755	443	192.168.2.9	23.200.0.9
Sep 6, 2024 14:20:01.280287981 CEST	443	49755	23.200.0.9	192.168.2.9
Sep 6, 2024 14:20:01.280368090 CEST	49755	443	192.168.2.9	23.200.0.9
Sep 6, 2024 14:20:01.280551910 CEST	49755	443	192.168.2.9	23.200.0.9
Sep 6, 2024 14:20:01.280563116 CEST	443	49755	23.200.0.9	192.168.2.9
Sep 6, 2024 14:20:01.760894060 CEST	443	49755	23.200.0.9	192.168.2.9
Sep 6, 2024 14:20:01.761346102 CEST	49755	443	192.168.2.9	23.200.0.9
Sep 6, 2024 14:20:01.761368990 CEST	443	49755	23.200.0.9	192.168.2.9
Sep 6, 2024 14:20:01.761696100 CEST	443	49755	23.200.0.9	192.168.2.9
Sep 6, 2024 14:20:01.762011051 CEST	49755	443	192.168.2.9	23.200.0.9
Sep 6, 2024 14:20:01.762089014 CEST	443	49755	23.200.0.9	192.168.2.9
Sep 6, 2024 14:20:01.762166023 CEST	49755	443	192.168.2.9	23.200.0.9
Sep 6, 2024 14:20:01.808506966 CEST	443	49755	23.200.0.9	192.168.2.9
Sep 6, 2024 14:20:01.900398016 CEST	443	49755	23.200.0.9	192.168.2.9
Sep 6, 2024 14:20:01.900419950 CEST	443	49755	23.200.0.9	192.168.2.9
Sep 6, 2024 14:20:01.900542974 CEST	443	49755	23.200.0.9	192.168.2.9
Sep 6, 2024 14:20:01.900599003 CEST	49755	443	192.168.2.9	23.200.0.9
Sep 6, 2024 14:20:01.900638103 CEST	49755	443	192.168.2.9	23.200.0.9
Sep 6, 2024 14:20:01.901067972 CEST	49755	443	192.168.2.9	23.200.0.9
Sep 6, 2024 14:20:01.901087046 CEST	443	49755	23.200.0.9	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 6, 2024 14:17:59.626478910 CEST	53	57740	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:00.596585035 CEST	57959	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:00.596718073 CEST	50456	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:01.774454117 CEST	53	58744	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:01.786269903 CEST	53	51815	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:01.856779099 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.167371035 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.405359030 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.406462908 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.544450998 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.590090990 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.590125084 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.590137959 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.590152025 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.590883017 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.592196941 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.592982054 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.593141079 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.593451023 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.772697926 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.772722006 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.772733927 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.773086071 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.799371004 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.899991989 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.900068045 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.900079966 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.900093079 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.900105000 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.900116920 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.900129080 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.900146961 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.900161982 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.900177002 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.900377989 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.900463104 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.900561094 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.900607109 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.900657892 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.925790071 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:02.960958004 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.960987091 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:02.961231947 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:03.104624033 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:03.140115976 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:03.140167952 CEST	443	51414	52.123.243.83	192.168.2.9
Sep 6, 2024 14:18:03.140394926 CEST	51414	443	192.168.2.9	52.123.243.83
Sep 6, 2024 14:18:03.774411917 CEST	55775	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.774662971 CEST	61939	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.775341988 CEST	49689	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.775490999 CEST	58305	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.780745983 CEST	51788	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.780952930 CEST	56755	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.781361103 CEST	59403	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.781543970 CEST	58879	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.785036087 CEST	53	55775	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.786209106 CEST	53	61939	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.787919044 CEST	53	49689	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.787930012 CEST	53	58305	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.791312933 CEST	53	51788	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.791367054 CEST	53	56755	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.791465998 CEST	53	59403	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.791492939 CEST	53	58879	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.828265905 CEST	64523	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.828439951 CEST	52518	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:18:03.835405111 CEST	53	64523	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:03.835508108 CEST	53	52518	1.1.1.1	192.168.2.9
Sep 6, 2024 14:18:05.092056990 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.399970055 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.548542023 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.548566103 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.548578978 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.548590899 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.549011946 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.550955057 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.551054001 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.551342010 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.551454067 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.646189928 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.646208048 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.646218061 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.646229029 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.646707058 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.646838903 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.646913052 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.647253990 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.647460938 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.647676945 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.741559029 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.742770910 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.742871046 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:05.838373899 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.838771105 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.839225054 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:05.858930111 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:06.159732103 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:06.159732103 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:06.255518913 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:06.256434917 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:06.256448984 CEST	443	59412	162.159.61.3	192.168.2.9
Sep 6, 2024 14:18:06.263863087 CEST	59412	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:18:06.481240988 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.792505026 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.930100918 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.930124044 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.935395002 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.936397076 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.936410904 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.936423063 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.936435938 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:06.936990976 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.937074900 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.950428963 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.951541901 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.952044964 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.952707052 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.952743053 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:06.965584993 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.044832945 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.044851065 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.045350075 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.046147108 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.060424089 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.061017036 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.062228918 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.062633991 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.063822031 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.074740887 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.074992895 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.075067043 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:07.102638960 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:07.168060064 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:14.890172958 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:14.890296936 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:14.984491110 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:15.027719975 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:15.027743101 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:15.065608025 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:15.127907038 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:15.180449009 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:15.203380108 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:35.906809092 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:35.906809092 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:36.001236916 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:36.016175032 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:36.016196012 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:36.016546011 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:36.043723106 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:36.136228085 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:36.591188908 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:36.591244936 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:36.685121059 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:36.699728012 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:36.699815989 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:36.700123072 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:36.728761911 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:36.818211079 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:38.807574987 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:38.807821035 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:38.901832104 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:38.927874088 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:38.927886009 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:38.928178072 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:38.961417913 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:18:39.047744989 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:18:50.501353979 CEST	138	138	192.168.2.9	192.168.2.255
Sep 6, 2024 14:18:58.310183048 CEST	56244	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.619379997 CEST	56244	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.764090061 CEST	443	56244	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.764111042 CEST	443	56244	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.764122009 CEST	443	56244	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.764132023 CEST	443	56244	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.764146090 CEST	443	56244	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.765208006 CEST	56244	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.767030001 CEST	56244	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.767148018 CEST	56244	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.767401934 CEST	56244	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.767533064 CEST	56244	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.864212036 CEST	443	56244	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.864229918 CEST	443	56244	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.864238977 CEST	443	56244	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.864248991 CEST	443	56244	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.864564896 CEST	443	56244	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.864788055 CEST	443	56244	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.864860058 CEST	56244	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.864860058 CEST	56244	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.865056038 CEST	56244	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:18:58.960654974 CEST	443	56244	172.64.41.3	192.168.2.9
Sep 6, 2024 14:18:58.991925001 CEST	56244	443	192.168.2.9	172.64.41.3
Sep 6, 2024 14:19:06.885891914 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:19:06.993474960 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:19:06.993587017 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:19:06.994188070 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:19:07.023516893 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:19:07.112212896 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:19:07.919217110 CEST	61502	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:07.919284105 CEST	61502	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:07.919636965 CEST	61502	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:07.919728041 CEST	61502	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:08.301048994 CEST	61502	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:08.377625942 CEST	443	61502	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:08.378313065 CEST	61502	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:08.396095991 CEST	443	61502	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:08.396126986 CEST	443	61502	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:08.396339893 CEST	443	61502	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:08.396349907 CEST	443	61502	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:08.396550894 CEST	61502	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:08.396668911 CEST	61502	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:08.396750927 CEST	61502	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:08.473026037 CEST	443	61502	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:08.491255999 CEST	443	61502	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:08.491698027 CEST	61502	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:08.588417053 CEST	443	61502	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:08.588926077 CEST	443	61502	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:08.589060068 CEST	443	61502	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:08.589395046 CEST	61502	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:08.590518951 CEST	57461	443	192.168.2.9	142.251.163.84
Sep 6, 2024 14:19:08.590651989 CEST	57461	443	192.168.2.9	142.251.163.84
Sep 6, 2024 14:19:09.045336962 CEST	443	57461	142.251.163.84	192.168.2.9
Sep 6, 2024 14:19:09.045705080 CEST	443	57461	142.251.163.84	192.168.2.9
Sep 6, 2024 14:19:09.045751095 CEST	443	57461	142.251.163.84	192.168.2.9
Sep 6, 2024 14:19:09.045819998 CEST	443	57461	142.251.163.84	192.168.2.9
Sep 6, 2024 14:19:09.045831919 CEST	443	57461	142.251.163.84	192.168.2.9
Sep 6, 2024 14:19:09.045986891 CEST	57461	443	192.168.2.9	142.251.163.84
Sep 6, 2024 14:19:09.046590090 CEST	57461	443	192.168.2.9	142.251.163.84
Sep 6, 2024 14:19:09.046838045 CEST	57461	443	192.168.2.9	142.251.163.84
Sep 6, 2024 14:19:09.145931959 CEST	443	57461	142.251.163.84	192.168.2.9
Sep 6, 2024 14:19:09.145946980 CEST	443	57461	142.251.163.84	192.168.2.9
Sep 6, 2024 14:19:09.145953894 CEST	443	57461	142.251.163.84	192.168.2.9
Sep 6, 2024 14:19:09.146590948 CEST	57461	443	192.168.2.9	142.251.163.84
Sep 6, 2024 14:19:09.180516958 CEST	57461	443	192.168.2.9	142.251.163.84
Sep 6, 2024 14:19:09.181772947 CEST	443	57461	142.251.163.84	192.168.2.9
Sep 6, 2024 14:19:09.181797028 CEST	443	57461	142.251.163.84	192.168.2.9
Sep 6, 2024 14:19:09.181804895 CEST	443	57461	142.251.163.84	192.168.2.9
Sep 6, 2024 14:19:09.182233095 CEST	57461	443	192.168.2.9	142.251.163.84
Sep 6, 2024 14:19:09.182311058 CEST	57461	443	192.168.2.9	142.251.163.84
Sep 6, 2024 14:19:09.316545963 CEST	443	57461	142.251.163.84	192.168.2.9
Sep 6, 2024 14:19:09.355761051 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:19:09.355814934 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:19:09.449851036 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:19:09.463680029 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:19:09.463690042 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:19:09.463992119 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:19:09.493045092 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:19:09.582597971 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:19:38.495134115 CEST	63304	443	192.168.2.9	142.251.41.14
Sep 6, 2024 14:19:38.591995001 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:19:38.616612911 CEST	443	63304	142.251.41.14	192.168.2.9
Sep 6, 2024 14:19:40.403511047 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:40.403772116 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:40.403995037 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:40.404119968 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:41.414762974 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:41.414763927 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:41.415194035 CEST	57335	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:19:41.415347099 CEST	59548	53	192.168.2.9	1.1.1.1
Sep 6, 2024 14:19:41.415412903 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:41.415455103 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:41.422355890 CEST	53	59548	1.1.1.1	192.168.2.9
Sep 6, 2024 14:19:41.422877073 CEST	53	57335	1.1.1.1	192.168.2.9
Sep 6, 2024 14:19:41.423998117 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:41.424154043 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:41.539155006 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:41.742562056 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:42.033369064 CEST	443	57546	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:42.033390045 CEST	443	57546	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:42.033409119 CEST	443	57546	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:42.033420086 CEST	443	57546	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:42.033430099 CEST	443	57546	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:42.033440113 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:42.033457041 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:42.033468962 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:42.033479929 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:42.033490896 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:42.033504009 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:42.034426928 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:42.034570932 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:42.035231113 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:42.035511017 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:42.035559893 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:42.035656929 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:42.035722017 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:42.036014080 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:42.054929972 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:42.129456997 CEST	443	57546	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:42.129473925 CEST	443	57546	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:42.130152941 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:42.213651896 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:42.213670969 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:42.214205027 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:42.214454889 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:42.224093914 CEST	443	57546	162.159.61.3	192.168.2.9
Sep 6, 2024 14:19:42.242424965 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:42.258532047 CEST	57546	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:19:42.258865118 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:42.266168118 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:42.266530991 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:42.268174887 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:42.304940939 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:42.472268105 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:19:59.932815075 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:19:59.932861090 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:20:00.114140034 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:20:00.146817923 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:20:00.147635937 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:20:00.156244993 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:20:00.196054935 CEST	60304	443	192.168.2.9	216.58.206.78
Sep 6, 2024 14:20:00.362415075 CEST	443	60304	216.58.206.78	192.168.2.9
Sep 6, 2024 14:20:00.719593048 CEST	50301	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.024739027 CEST	50301	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.169313908 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.169357061 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.169529915 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.169542074 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.169552088 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.170973063 CEST	50301	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.176196098 CEST	50301	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.177232981 CEST	50301	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.177546024 CEST	50301	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.179085970 CEST	50301	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.179414034 CEST	50301	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.273603916 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.273628950 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.273638964 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.273648024 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.274060011 CEST	50301	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.274193048 CEST	50301	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.276819944 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.279124022 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.279134035 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.279395103 CEST	50301	443	192.168.2.9	162.159.61.3
Sep 6, 2024 14:20:01.371120930 CEST	443	50301	162.159.61.3	192.168.2.9
Sep 6, 2024 14:20:01.399410963 CEST	50301	443	192.168.2.9	162.159.61.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 6, 2024 14:18:02.597484112 CEST	192.168.2.9	1.1.1.1	c2be	(Port unreachable)	Destination Unreachable
Sep 6, 2024 14:19:38.592106104 CEST	192.168.2.9	142.251.41.14	2848	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 6, 2024 14:18:00.596585035 CEST	192.168.2.9	1.1.1.1	0xfc04	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:00.596718073 CEST	192.168.2.9	1.1.1.1	0xe931	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Sep 6, 2024 14:18:03.774411917 CEST	192.168.2.9	1.1.1.1	0x61df	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.774662971 CEST	192.168.2.9	1.1.1.1	0xbadc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 14:18:03.775341988 CEST	192.168.2.9	1.1.1.1	0xc19e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.775490999 CEST	192.168.2.9	1.1.1.1	0xc88a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 14:18:03.780745983 CEST	192.168.2.9	1.1.1.1	0x1881	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.780952930 CEST	192.168.2.9	1.1.1.1	0x165a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 14:18:03.781361103 CEST	192.168.2.9	1.1.1.1	0x216	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.781543970 CEST	192.168.2.9	1.1.1.1	0x5d3f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 14:18:03.828265905 CEST	192.168.2.9	1.1.1.1	0x74d2	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.828439951 CEST	192.168.2.9	1.1.1.1	0x4adc	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 6, 2024 14:19:41.415194035 CEST	192.168.2.9	1.1.1.1	0x9e26	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:19:41.415347099 CEST	192.168.2.9	1.1.1.1	0x8521	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 6, 2024 14:17:59.417303085 CEST	1.1.1.1	192.168.2.9	0x79ed	No error (0)	svc.ha-teams.office.com	svc.ms-acdc-teams.office.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 14:17:59.417303085 CEST	1.1.1.1	192.168.2.9	0x79ed	No error (0)	svc.ms-acdc-teams.office.com		52.123.243.83	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:17:59.417303085 CEST	1.1.1.1	192.168.2.9	0x79ed	No error (0)	svc.ms-acdc-teams.office.com		52.123.243.207	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:17:59.417303085 CEST	1.1.1.1	192.168.2.9	0x79ed	No error (0)	svc.ms-acdc-teams.office.com		52.123.224.67	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:00.604667902 CEST	1.1.1.1	192.168.2.9	0xfc04	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 14:18:00.604835987 CEST	1.1.1.1	192.168.2.9	0xe931	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 14:18:02.582767963 CEST	1.1.1.1	192.168.2.9	0x6882	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 6, 2024 14:18:02.582767963 CEST	1.1.1.1	192.168.2.9	0x6882	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.785036087 CEST	1.1.1.1	192.168.2.9	0x61df	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.785036087 CEST	1.1.1.1	192.168.2.9	0x61df	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.786209106 CEST	1.1.1.1	192.168.2.9	0xbadc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 14:18:03.787919044 CEST	1.1.1.1	192.168.2.9	0xc19e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.787919044 CEST	1.1.1.1	192.168.2.9	0xc19e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.787930012 CEST	1.1.1.1	192.168.2.9	0xc88a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 14:18:03.791312933 CEST	1.1.1.1	192.168.2.9	0x1881	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.791312933 CEST	1.1.1.1	192.168.2.9	0x1881	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.791465998 CEST	1.1.1.1	192.168.2.9	0x216	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.791465998 CEST	1.1.1.1	192.168.2.9	0x216	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.791492939 CEST	1.1.1.1	192.168.2.9	0x5d3f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 14:18:03.835405111 CEST	1.1.1.1	192.168.2.9	0x74d2	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.835405111 CEST	1.1.1.1	192.168.2.9	0x74d2	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 6, 2024 14:18:03.835508108 CEST	1.1.1.1	192.168.2.9	0x4adc	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 6, 2024 14:19:41.422877073 CEST	1.1.1.1	192.168.2.9	0x9e26	No error (0)	play.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

config.edge.skype.com

edgeassetservice.azureedge.net

fs.microsoft.com

chrome.cloudflare-dns.com

https:

www.google.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49708	52.123.243.83	443	8184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:00 UTC	627	OUT	GET /config/v1/Edge/117.0.2045.47?clientId=8269936211167973170&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=1&mngd=0&installdate=1725625075&edu=&bphint=2&soobedate=1696496377&fg=1 HTTP/1.1 Host: config.edge.skype.com Connection: keep-alive Accept-Encoding: gzip Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
2024-09-06 12:18:00 UTC	1175	IN	HTTP/1.1 200 OK Cache-Control: no-cache,max-age=3600 Content-Length: 735 Content-Type: application/json Expires: Fri, 06 Sep 2024 13:18:00 GMT ETag: "1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI=" Server: Microsoft-IIS/10.0 request-id: 8d55fd04-0282-d29e-9be2-174e635d5730 X-BackEndHttpStatus: 200 X-Content-Type-Options: nosniff X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"NelEcsUpload1","max_age":604800,"endpoints":[{"url":"https://ecs.nel.measure.office.net?TenantId=Edge&DesusertionEndpoint=MIRA-SIP-FR2&FrontEnd=MIRA"}],"include_subdomains":true} NEL: {"report_to":"NelEcsUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: 8d55fd04-0282-d29e-9be2-174e635d5730 FR2P281CA0063 2024-09-06T12:18:00.628Z Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: FRA X-FEProxyInfo: FR2P281CA0063.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: FRA X-Powered-By: ASP.NET X-FEServer: FR2P281CA0063 Date: Fri, 06 Sep 2024 12:18:00 GMT Connection: close
2024-09-06 12:18:00 UTC	735	IN	Data Raw: 7b 22 45 43 53 22 3a 7b 22 45 78 63 6c 75 64 65 45 78 74 65 72 6e 61 6c 43 6f 6e 66 69 67 49 64 73 49 6e 4c 6f 67 22 3a 74 72 75 65 2c 22 43 6f 6e 66 69 67 4c 6f 67 54 61 72 67 65 74 22 3a 22 65 64 67 65 5f 73 74 61 62 6c 65 22 7d 2c 22 45 64 67 65 46 69 72 73 74 52 75 6e 43 6f 6e 66 69 67 22 3a 7b 22 45 6d 70 74 79 45 64 67 65 46 69 72 73 74 52 75 6e 43 6f 6e 66 69 67 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 65 65 66 72 63 22 5d 7d 7d 2c 22 53 65 67 6d 65 6e 74 61 74 69 6f 6e 22 3a 7b 22 57 57 45 41 6c 6c 22 3a 22 66 61 6c 73 65 22 2c 22 73 63 70 66 75 6c 6c 22 3a 30 2c 22 73 63 70 67 75 61 72 64 22 3a 30 2c 22 73 63 70 76 65 72 22 3a 30 2c 22 4d 33 36 35 43 6f 72 65 41 6c 6c 22 3a 22 66 61 6c 73 65 22 2c 22 43 6f 6e 74 65 6e 74 Data Ascii: {"ECS":{"ExcludeExternalConfigIdsInLog":true,"ConfigLogTarget":"edge_stable"},"EdgeFirstRunConfig":{"EmptyEdgeFirstRunConfig":{"enableFeatures":["eefrc"]}},"Segmentation":{"WWEAll":"false","scpfull":0,"scpguard":0,"scpver":0,"M365CoreAll":"false","Content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49721	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:02 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-06 12:18:02 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=16036 Date: Fri, 06 Sep 2024 12:18:02 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49724	13.107.246.60	443	8184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:03 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 12:18:03 UTC	583	IN	HTTP/1.1 200 OK Date: Fri, 06 Sep 2024 12:18:03 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: ed2d6e16-301e-006f-0748-ffc0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240906T121803Z-16579567576rhxz5kgqdm3tfq00000000dw000000000kd0q Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-09-06 12:18:03 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-09-06 12:18:03 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-09-06 12:18:03 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-09-06 12:18:03 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-09-06 12:18:03 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49725	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:03 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-06 12:18:03 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=25939 Date: Fri, 06 Sep 2024 12:18:03 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-06 12:18:03 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49726	13.107.246.60	443	8184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:03 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 12:18:03 UTC	531	IN	HTTP/1.1 200 OK Date: Fri, 06 Sep 2024 12:18:03 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Wed, 04 Sep 2024 17:17:44 GMT ETag: 0x8DCCD057D8088C1 x-ms-request-id: f7ce689d-701e-002c-4072-ffea3a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240906T121803Z-16579567576h266g9d6dee9ff80000000e0000000000d1p4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-06 12:18:03 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49734	172.64.41.3	443	8184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:04 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 12:18:04 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 12:18:04 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 12:18:04 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bee66492aa043ed-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 12:18:04 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49733	162.159.61.3	443	8184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:04 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 12:18:04 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 12:18:04 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 12:18:04 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bee6649485dc325-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 12:18:04 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 17 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49738	172.64.41.3	443	8184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:04 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 12:18:04 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 12:18:04 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 12:18:04 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bee66496a5b0cba-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 12:18:04 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 94 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49737	162.159.61.3	443	8184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:04 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 12:18:04 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 12:18:04 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 12:18:04 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bee66494c3b5e6e-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 12:18:04 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0b 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49736	162.159.61.3	443	8184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:04 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-06 12:18:04 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-06 12:18:04 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 06 Sep 2024 12:18:04 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bee66495eee43dd-EWR alt-svc: h3=":443"; ma=86400
2024-09-06 12:18:04 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49742	142.251.41.14	443	8184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:06 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-06 12:18:06 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 06 Sep 2024 12:18:06 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49741	142.251.41.14	443	8184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:06 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-06 12:18:06 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 06 Sep 2024 12:18:06 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49743	142.250.81.228	443	8184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:06 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-06 12:18:06 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 06 Sep 2024 11:07:05 GMT Expires: Sat, 14 Sep 2024 11:07:05 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 4261 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-06 12:18:06 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-06 12:18:06 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-06 12:18:06 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-06 12:18:06 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-06 12:18:06 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49746	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:13 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vYADLpVThOuKkyt&MD=reXRoom2 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-06 12:18:13 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 86957f9b-1249-48df-b31f-cf2b3477b4ff MS-RequestId: 2810abb9-6c89-4199-9e19-ad7d6614e834 MS-CV: Tl6Ehxf1mUC99bSH.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Sep 2024 12:18:12 GMT Connection: close Content-Length: 24490
2024-09-06 12:18:13 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-06 12:18:13 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49748	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:18:52 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vYADLpVThOuKkyt&MD=reXRoom2 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-06 12:18:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 7e4f5589-ffe8-40dd-b6b5-e2da3d76e3b9 MS-RequestId: e3852146-8293-43ad-a754-acfdf4592927 MS-CV: 9JBzzcNb5kqj/Ss0.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Sep 2024 12:18:52 GMT Connection: close Content-Length: 30005
2024-09-06 12:18:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-06 12:18:53 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49755	23.200.0.9	443	8184	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-06 12:20:01 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-06 12:20:01 UTC	351	IN	HTTP/1.1 403 Forbidden Content-Length: 2342 Content-Type: text/html Date: Fri, 06 Sep 2024 12:20:01 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.09ac2d17.1725625201.832e251 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-09-06 12:20:01 UTC	1938	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 20 41 70 70 20 2d 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 23 66 65 61 74 75 72 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 36 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 39 35 Data Ascii: <!DOCTYPE html><html><head> <title>Web App - Unavailable</title> <style type="text/css"> html { height: 100%; width: 100%; } #feature { width: 960px; margin: 95
2024-09-06 12:20:01 UTC	404	IN	Data Raw: 74 20 61 67 61 69 6e 20 73 6f 6f 6e 2e 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 69 64 3d 22 74 6f 41 64 6d 69 6e 22 3e 49 66 20 79 6f 75 20 61 72 65 20 74 68 65 20 77 65 62 20 61 70 70 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 2c 20 70 6c 65 61 73 65 20 66 69 6e 64 20 74 68 65 20 63 6f 6d 6d 6f 6e 20 34 30 33 20 65 72 72 6f 72 20 73 63 65 6e 61 72 69 6f 73 20 61 6e 64 20 72 65 73 6f 6c 75 74 69 6f 6e 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6f 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 66 77 6c 69 6e 6b 2f 3f 6c 69 6e 6b 69 64 3d 32 30 39 35 30 30 37 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 68 65 72 65 3c 2f 61 3e 2e 20 46 6f 72 20 66 75 72 74 68 65 72 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 Data Ascii: t again soon.</p> <p id="toAdmin">If you are the web app administrator, please find the common 403 error scenarios and resolution <a href="https://go.microsoft.com/fwlink/?linkid=2095007" target="_blank">here</a>. For further troubleshoot

Target ID:	0
Start time:	08:17:55
Start date:	06/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xbc0000
File size:	917'504 bytes
MD5 hash:	4E47B9E5520B1A3BD0C8F59FF741BEF9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	08:17:55
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:17:56
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2084,i,10117366707530549767,18319138764020029181,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:17:56
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:17:56
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=2632,i,13622407252591464320,6831899295941176211,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:18:00
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7300 --field-trial-handle=2632,i,13622407252591464320,6831899295941176211,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:18:00
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7092 --field-trial-handle=2632,i,13622407252591464320,6831899295941176211,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:18:13
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:18:14
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2232,i,13285841369561515473,16385320068562832871,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:18:14
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4220 --field-trial-handle=2232,i,13285841369561515473,16385320068562832871,262144 /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:18:21
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:18:22
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2024,i,5048425808482636078,123280307142444447,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:18:22
Start date:	06/09/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3264 --field-trial-handle=2024,i,5048425808482636078,123280307142444447,262144 /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	1400
Total number of Limit Nodes:	39

Executed Functions

Function 00BC42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00BC430D

Part of subcall function 00BC6B57: _wcslen.LIBCMT ref: 00BC6B6A

GetCurrentProcess.KERNEL32(?,00C5CB64,00000000,?,?), ref: 00BC4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00BC4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00BC4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00BC4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00BC4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00BC447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00BC44A0

Strings

kernel32.dll, xrefs: 00BC444F
GetNativeSystemInfo, xrefs: 00BC4460
|O, xrefs: 00C036F8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: fa4b33570ad982f945db3afa91985ff67e8ca0e9b3afc655323ad52ee232be78
Instruction ID: b8961197de2d44e06517def6352ce9b5685c84ca012e0d52527b2fec78165cd2
Opcode Fuzzy Hash: fa4b33570ad982f945db3afa91985ff67e8ca0e9b3afc655323ad52ee232be78
Instruction Fuzzy Hash: 13A1706995A3C2DFCB16C769788B7AD7FF87B26300B1C489EEC5193B71D6204648CB21

Function 00BC42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00BC50AA,?,?,00000000,00000000), ref: 00BC42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00BC50AA,?,?,00000000,00000000), ref: 00BC42C9
LoadResource.KERNEL32(?,00000000,?,?,00BC50AA,?,?,00000000,00000000,?,?,?,?,?,?,00BC4F20), ref: 00C035BE
SizeofResource.KERNEL32(?,00000000,?,?,00BC50AA,?,?,00000000,00000000,?,?,?,?,?,?,00BC4F20), ref: 00C035D3
LockResource.KERNEL32(00BC50AA,?,?,00BC50AA,?,?,00000000,00000000,?,?,?,?,?,?,00BC4F20,?), ref: 00C035E6

Strings

SCRIPT, xrefs: 00BC42BF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 8f676c25477e8ce416ec6dcd967344dd269966e87d1c5ca09e743e3400e39ff8
Instruction ID: 7de1f6a7b621013db5fc8a1ed88c0bc52e3f08538c699f950d3042094d7b8430
Opcode Fuzzy Hash: 8f676c25477e8ce416ec6dcd967344dd269966e87d1c5ca09e743e3400e39ff8
Instruction Fuzzy Hash: 28117074200700BFD7258B65DC89F2B7BB9EBC5B52F10416DB4169A290DB71D944D620

Function 00C02BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00BC2B6B

Part of subcall function 00BC3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00C91418,?,00BC2E7F,?,?,?,00000000), ref: 00BC3A78

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00C82224), ref: 00C02C10
ShellExecuteW.SHELL32(00000000,?,?,00C82224), ref: 00C02C17

Strings

runas, xrefs: 00C02C0B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: b0ab4442872cfc316c1ab3b03b00b1d49b2955e9ac90a1a5891f93c0aaabf285
Instruction ID: ee3ce294945f8e41aba332384a3701b9b08cde7bb33a1f4dd2460a81f2420ba4
Opcode Fuzzy Hash: b0ab4442872cfc316c1ab3b03b00b1d49b2955e9ac90a1a5891f93c0aaabf285
Instruction Fuzzy Hash: 7011D6312083419ECB14FF60D89AFBEBBE4DF95751F4844ADF582530A2CF218A4AC712

Function 00C2DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00C05222), ref: 00C2DBCE
GetFileAttributesW.KERNELBASE(?), ref: 00C2DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00C2DBEE
FindClose.KERNEL32(00000000), ref: 00C2DBFA

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 486336b831e3ed84aa55778ff14d74e9c5c85e389d6b9b3758985bb1a895682c
Instruction ID: 4326598e90db5c3267002adbafd9f045cb4b299a51c323f780f4564ff152f7e3
Opcode Fuzzy Hash: 486336b831e3ed84aa55778ff14d74e9c5c85e389d6b9b3758985bb1a895682c
Instruction Fuzzy Hash: 93F0A030810B205B83206B78AC4DAAE376C9E11336B104702F836E24F0EFB05A94C696

Function 00C4AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00C4B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C4B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C4B1D4
_wcslen.LIBCMT ref: 00C4B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C4B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C4B236
_wcslen.LIBCMT ref: 00C4B332

Part of subcall function 00C305A7: GetStdHandle.KERNEL32(000000F6), ref: 00C305C6

_wcslen.LIBCMT ref: 00C4B34B
_wcslen.LIBCMT ref: 00C4B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C4B3B6
GetLastError.KERNEL32(00000000), ref: 00C4B407
CloseHandle.KERNEL32(?), ref: 00C4B439
CloseHandle.KERNEL32(00000000), ref: 00C4B44A
CloseHandle.KERNEL32(00000000), ref: 00C4B45C
CloseHandle.KERNEL32(00000000), ref: 00C4B46E
CloseHandle.KERNEL32(?), ref: 00C4B4E3

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: f4b0ef6712f447dc78b193b1692776cdf684a40737fc8fbff10dd210d39705b1
Instruction ID: e8d3a308ca180c420e2ae90ba6c73487f81a36d48697eda32213a449fd0bcc5a
Opcode Fuzzy Hash: f4b0ef6712f447dc78b193b1692776cdf684a40737fc8fbff10dd210d39705b1
Instruction Fuzzy Hash: 14F1BC716083409FC724EF25C891B6EBBE5BF85310F14899DF8999B2A2DB31ED44CB52

Function 00BCD730 Relevance: 21.6, APIs: 14, Instructions: 621windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00BCD807
timeGetTime.WINMM ref: 00BCDA07
PeekMessageW.USER32(BCD2B7BC,00000000,00000000,00000000,00000001), ref: 00BCDB28
TranslateMessage.USER32(BCD2B7BC), ref: 00BCDB7B
DispatchMessageW.USER32(BCD2B7BC), ref: 00BCDB89
PeekMessageW.USER32(BCD2B7BC,00000000,00000000,00000000,00000001), ref: 00BCDB9F
Sleep.KERNELBASE(0000000A), ref: 00BCDBB1

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 68a794fb54c86f09af7ec6db3fa3275f58c1a07b87ba36f405d66dd029e5c27f
Instruction ID: a8133af287ddceca614911261f9539547ccbdd010577492a8e4b3d601395ef82
Opcode Fuzzy Hash: 68a794fb54c86f09af7ec6db3fa3275f58c1a07b87ba36f405d66dd029e5c27f
Instruction Fuzzy Hash: F342E338608341EFD724CF24C885FAAB7E0FF46304F1445ADE9A687291D770E994EB92

Function 00BC2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BC2D07
RegisterClassExW.USER32(00000030), ref: 00BC2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BC2D42
InitCommonControlsEx.COMCTL32(?), ref: 00BC2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BC2D6F
LoadIconW.USER32(000000A9), ref: 00BC2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BC2D94

Strings

0, xrefs: 00BC2CE9
AutoIt v3 GUI, xrefs: 00BC2D23
TaskbarCreated, xrefs: 00BC2D37
+, xrefs: 00BC2CF0

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 64ff02e8d68a7beaae63b539a7e67b1b85629647f9edd1f2f9e4a3ffe1dc12a2
Instruction ID: ccdb0595e4ce380080c922966f5f693fb14f1d8f86b5ca3a871ae79a97470af0
Opcode Fuzzy Hash: 64ff02e8d68a7beaae63b539a7e67b1b85629647f9edd1f2f9e4a3ffe1dc12a2
Instruction Fuzzy Hash: F821B2B9901319EFDB00DFA4EC8AB9DBBB4FB08701F14411AE911B62A0D7B54584CF95

Function 00C0065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C0039A: CreateFileW.KERNELBASE(00000000,00000000,?,00C00704,?,?,00000000,?,00C00704,00000000,0000000C), ref: 00C003B7

GetLastError.KERNEL32 ref: 00C0076F
__dosmaperr.LIBCMT ref: 00C00776
GetFileType.KERNELBASE(00000000), ref: 00C00782
GetLastError.KERNEL32 ref: 00C0078C
__dosmaperr.LIBCMT ref: 00C00795
CloseHandle.KERNEL32(00000000), ref: 00C007B5
CloseHandle.KERNEL32(?), ref: 00C008FF
GetLastError.KERNEL32 ref: 00C00931
__dosmaperr.LIBCMT ref: 00C00938

Strings

H, xrefs: 00C008BD

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 9dfb285dd4355ec99d56050aa462c8fff13496478193c7836ba0f88a5de3d2ab
Instruction ID: 02784c9752579d7fccca2cfacc5eda399cd3171b78402d6a0a7ef9ab0d7e2f7a
Opcode Fuzzy Hash: 9dfb285dd4355ec99d56050aa462c8fff13496478193c7836ba0f88a5de3d2ab
Instruction Fuzzy Hash: 1CA12732A001488FDF19AF68D855BAD7BE0EB06320F254159F815AB2E1D7359E12CB91

Function 00BC344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BC3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00C91418,?,00BC2E7F,?,?,?,00000000), ref: 00BC3A78

Part of subcall function 00BC3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00BC3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00BC356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00C0318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00C031CE
RegCloseKey.ADVAPI32(?), ref: 00C03210
_wcslen.LIBCMT ref: 00C03277
_wcslen.LIBCMT ref: 00C03286

Strings

Include, xrefs: 00C03184, 00C031C5
\Include\, xrefs: 00BC3527
Software\AutoIt v3\AutoIt, xrefs: 00BC3560
\, xrefs: 00C0328C

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: a85585fbf030a0eb19859b56d45685b9374f52cc41cb580b89b308e4a7cc6d9c
Instruction ID: f169b109a93a8fdf935bf4839fbfe08dd8e6a7c10b1ce91b1364b274d3ac0891
Opcode Fuzzy Hash: a85585fbf030a0eb19859b56d45685b9374f52cc41cb580b89b308e4a7cc6d9c
Instruction Fuzzy Hash: 74715971405301AEC714DF65DC8AAAFBBECFB85740B40056EF585931B1EB309A48CB61

Function 00BC2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00BC2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00BC2B9D
LoadIconW.USER32(00000063), ref: 00BC2BB3
LoadIconW.USER32(000000A4), ref: 00BC2BC5
LoadIconW.USER32(000000A2), ref: 00BC2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00BC2BEF
RegisterClassExW.USER32(?), ref: 00BC2C40

Part of subcall function 00BC2CD4: GetSysColorBrush.USER32(0000000F), ref: 00BC2D07
Part of subcall function 00BC2CD4: RegisterClassExW.USER32(00000030), ref: 00BC2D31
Part of subcall function 00BC2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00BC2D42
Part of subcall function 00BC2CD4: InitCommonControlsEx.COMCTL32(?), ref: 00BC2D5F
Part of subcall function 00BC2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00BC2D6F
Part of subcall function 00BC2CD4: LoadIconW.USER32(000000A9), ref: 00BC2D85
Part of subcall function 00BC2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00BC2D94

Strings

AutoIt v3, xrefs: 00BC2C2F
0, xrefs: 00BC2C0F
#, xrefs: 00BC2C16

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: e35060d777f4d932b965aebf66bdb43dc53190c0573e0930ce0ddb0b59920b68
Instruction ID: ead301a37e8b185043aed4f550682fbf9f542c71d6fad91de3b00836f7b84151
Opcode Fuzzy Hash: e35060d777f4d932b965aebf66bdb43dc53190c0573e0930ce0ddb0b59920b68
Instruction Fuzzy Hash: 05212C75E00315AFDB109FA5EC9ABAD7FB4FB48B50F08415BEA04A66B0D7B14580CF94

Function 00BC3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00BC316A,?,?), ref: 00BC31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00BC316A,?,?), ref: 00BC3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00BC3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00BC316A,?,?), ref: 00BC3232
CreatePopupMenu.USER32 ref: 00BC3246
PostQuitMessage.USER32(00000000), ref: 00BC3267

Strings

TaskbarCreated, xrefs: 00BC322D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 05fcc89426c58e5e00810a35c57a78606dbd745aee5365c261a1b05573da6b86
Instruction ID: 6990a9caff8de349c3dc87e1243d1c8d40e19f3a8e21cfa25b4b6cf5d40b0c4a
Opcode Fuzzy Hash: 05fcc89426c58e5e00810a35c57a78606dbd745aee5365c261a1b05573da6b86
Instruction Fuzzy Hash: 3D412735240301AEDF151B789D8EFBD3AE9E705B40F4C819EF912A95A1C7718F40EB61

Function 00BC2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00BC2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00BC2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00BC1CAD,?), ref: 00BC2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00BC1CAD,?), ref: 00BC2CCF

Strings

AutoIt v3, xrefs: 00BC2C89, 00BC2C8E, 00BC2C8F
edit, xrefs: 00BC2CAC

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: c1835119f73386717d1dd02b822428708aae8493f8d0d4d18d830cc690a83a35
Instruction ID: 497e6f817937f44e20c97b99852af4e98a549f5e3903d2613f73c3d259cb36e9
Opcode Fuzzy Hash: c1835119f73386717d1dd02b822428708aae8493f8d0d4d18d830cc690a83a35
Instruction Fuzzy Hash: 1AF0DA795403917EEB311B27AC4EF7B2EBDE7CAF51B04009AFD04A25B0C6715894DAB4

Function 00C2E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00C2E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00C2E9A5
Sleep.KERNEL32(00000000), ref: 00C2E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00C2E9B7
Sleep.KERNELBASE ref: 00C2E9F3

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: b0b00e32c9f720381e9708dff3eeb29f3a9505152a7b0b7393f7ed542f6d94e6
Instruction ID: a71dc62db951ec4097fed3ee62c5aad481d2f45b641d608db8e7d8dd7f86f90b
Opcode Fuzzy Hash: b0b00e32c9f720381e9708dff3eeb29f3a9505152a7b0b7393f7ed542f6d94e6
Instruction Fuzzy Hash: 97011735C01A39DBCF00ABE5EC99BEEBB78BB09701F000556E912B2251CB349695CBA1

Function 00BC3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00BC3B0F,SwapMouseButtons,00000004,?), ref: 00BC3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00BC3B0F,SwapMouseButtons,00000004,?), ref: 00BC3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00BC3B0F,SwapMouseButtons,00000004,?), ref: 00BC3B83

Strings

Control Panel\Mouse, xrefs: 00BC3B3E

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: aaf18b79da38fe3d431d683fbd4220d470b49e6c9d0fffebcb724ebad1cdb11d
Instruction ID: 073010e5557769e7bbce4431ffd3129a49f6a072c7a651213f7b9840e9c3cc74
Opcode Fuzzy Hash: aaf18b79da38fe3d431d683fbd4220d470b49e6c9d0fffebcb724ebad1cdb11d
Instruction Fuzzy Hash: 47112AB5510208FFDB208FA5DC84FEFB7F8EF44B55B508499B805E7110D2319E409B60

Function 00BC3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00C033A2

Part of subcall function 00BC6B57: _wcslen.LIBCMT ref: 00BC6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00BC3A04

Strings

Line: , xrefs: 00C033EB

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: a0c6dd6e96f97f9f83b42ac14ad9d0c552a21c27c047b44834ce0e7ae882422f
Instruction ID: dd876d8298ce0684a0ac322a2ab98ae04970d6058d1edbb53b28c064bc0cce43
Opcode Fuzzy Hash: a0c6dd6e96f97f9f83b42ac14ad9d0c552a21c27c047b44834ce0e7ae882422f
Instruction Fuzzy Hash: 2931E571408345AED720EB20DC4AFEFB3E8AB40710F4449AEF599930A1DB709A48C7C6

Function 00BDFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00BE0668

Part of subcall function 00BE32A4: RaiseException.KERNEL32(?,?,?,00BE068A,?,00C91444,?,?,?,?,?,?,00BE068A,00BC1129,00C88738,00BC1129), ref: 00BE3304

__CxxThrowException@8.LIBVCRUNTIME ref: 00BE0685

Strings

Unknown exception, xrefs: 00BE0692

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 6e805fbbe2eb68494cdfca0e5dbfb861a0372d5e198caa43860da334ecf167c5
Instruction ID: b23b2aabef08165c3ad65a9cb24550f52769e63a6a473780c1bbcdfe6b8e6446
Opcode Fuzzy Hash: 6e805fbbe2eb68494cdfca0e5dbfb861a0372d5e198caa43860da334ecf167c5
Instruction Fuzzy Hash: C2F0FC3490028D77CF04B666D886D5E77FD9E00310BA045F5B924D6591FFB1DA99C6D0

Function 00BC10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00BC1BF4
Part of subcall function 00BC1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00BC1BFC
Part of subcall function 00BC1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00BC1C07
Part of subcall function 00BC1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00BC1C12
Part of subcall function 00BC1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00BC1C1A
Part of subcall function 00BC1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00BC1C22

Part of subcall function 00BC1B4A: RegisterWindowMessageW.USER32(00000004,?,00BC12C4), ref: 00BC1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00BC136A
OleInitialize.OLE32 ref: 00BC1388
CloseHandle.KERNEL32(00000000,00000000), ref: 00C024AB

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 597716ed5153a87d49ce1a8eccd617343955cc29c0eb938947fb2941f58126f0
Instruction ID: 6a39db6b603871eec5237b1831195069c7a0b17877471471933cd1c9d119814b
Opcode Fuzzy Hash: 597716ed5153a87d49ce1a8eccd617343955cc29c0eb938947fb2941f58126f0
Instruction Fuzzy Hash: 4471AAB89113428F8B85DF69A98FB5D3AE0EB8874435F856F9C1AD72A1EB304445CF48

Function 00C2C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00BC3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00C2C259
KillTimer.USER32(?,00000001,?,?), ref: 00C2C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C2C270

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: ae50b914819f23fc4e760ebe4bb9894c2f136883eabe6042bc628d36eec17b32
Instruction ID: a91c5194ab0394518e81916cc8975b250285461aee9c98ce0da51f56558a3210
Opcode Fuzzy Hash: ae50b914819f23fc4e760ebe4bb9894c2f136883eabe6042bc628d36eec17b32
Instruction Fuzzy Hash: D3318470904354AFEB22DB64D895BEEBBECAB06344F04049AD5AAA7241C7745A84CB51

Function 00BF86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00BF85CC,?,00C88CC8,0000000C), ref: 00BF8704
GetLastError.KERNEL32(?,00BF85CC,?,00C88CC8,0000000C), ref: 00BF870E
__dosmaperr.LIBCMT ref: 00BF8739

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: abd00812ea1bbf391faa5bce77b6a727a5bf2ac5e57d9ad765a2748163bd8094
Instruction ID: ee2f121640ce5925fe97688d3e9ccd0fba424862bee05cb72c8a5071c59b0c0e
Opcode Fuzzy Hash: abd00812ea1bbf391faa5bce77b6a727a5bf2ac5e57d9ad765a2748163bd8094
Instruction Fuzzy Hash: 54012B33605A683AD6346238688977E67C9CB82779F3901D9FB19DB1D2DEB08C898254

Function 00BCDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(BCD2B7BC), ref: 00BCDB7B
DispatchMessageW.USER32(BCD2B7BC), ref: 00BCDB89
PeekMessageW.USER32(BCD2B7BC,00000000,00000000,00000000,00000001), ref: 00BCDB9F
Sleep.KERNELBASE(0000000A), ref: 00BCDBB1
TranslateAcceleratorW.USER32(?,?,BCD2B7BC), ref: 00C11CC9

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 64488818444fe388061fd77a96774f9651d6ca774fcf1523b04fc7348c27297f
Instruction ID: 28407d82aa3165f605a1e2e5ec0bde25e52f445e078ac1f24cf4c8ad1a2bc561
Opcode Fuzzy Hash: 64488818444fe388061fd77a96774f9651d6ca774fcf1523b04fc7348c27297f
Instruction Fuzzy Hash: F3F05E346443419BEB30CBA0CC99FEA73E8EB89351F544569EA1A970C0EB349588DB25

Function 00BD1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00BD17F6

Strings

CALL, xrefs: 00BD17C6

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 50993dd153a11e527ece2f9c1ed82e3723d51adfd477b069b3d2a94fe56ee3cf
Instruction ID: fcf63524b0db88a35cd908176c611dc4b40364ed1c8c640a05e6cdae394df754
Opcode Fuzzy Hash: 50993dd153a11e527ece2f9c1ed82e3723d51adfd477b069b3d2a94fe56ee3cf
Instruction Fuzzy Hash: EA227B70608201AFC714DF18C484B6AFBF1BF96314F1489AEF49A8B361E735E985DB52

Function 00BC2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00C02C8C

Part of subcall function 00BC3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BC3A97,?,?,00BC2E7F,?,?,?,00000000), ref: 00BC3AC2

Part of subcall function 00BC2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00BC2DC4

Strings

X, xrefs: 00C02C5A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 7b977f0f58dcfed8933f34cc960cede10ae99c16af3c3d2ef3107c0eb752287d
Instruction ID: e456cc881972b8eb138781f4732a271e980b425220300e3a325835eda73aaf0b
Opcode Fuzzy Hash: 7b977f0f58dcfed8933f34cc960cede10ae99c16af3c3d2ef3107c0eb752287d
Instruction Fuzzy Hash: 3A219371A002589FDF01EF94C849BEE7BF8AF48714F008099E505BB281DBB45A89CF61

Function 00BC3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00BC3908

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: e30d2d2076ee0a0332abf12e91622c1a9cceee02412a02ea518573a9aed283f5
Instruction ID: c276e2631449cd13f83928b698551b2a60276a066cd0855385b028174250057a
Opcode Fuzzy Hash: e30d2d2076ee0a0332abf12e91622c1a9cceee02412a02ea518573a9aed283f5
Instruction Fuzzy Hash: 3431A570504301DFD720DF24D885BABBBF8FB49708F44096EF99A97250E7B1AA44CB52

Function 00BDF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00BDF661

Part of subcall function 00BCD730: GetInputState.USER32 ref: 00BCD807

Sleep.KERNEL32(00000000), ref: 00C1F2DE

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 47989a95ea13da17af0e4e7c0ad3121355e68d471ab552079dbcdd933448c4c1
Instruction ID: df55df3ab76bddc2961ca372c79394e504ea9fc6bc0d36b82ba5881b5f516c2f
Opcode Fuzzy Hash: 47989a95ea13da17af0e4e7c0ad3121355e68d471ab552079dbcdd933448c4c1
Instruction Fuzzy Hash: 36F08C352407059FD310EF69D49AF6EB7E8EF69761F00006EE85AD7360DB70A840CB90

Function 00BCB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00BCBB4E

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 269060750e8af1fe3c7ff283836b78ee8bbc06ed8dd7a3853ecdb75b72c88bc2
Instruction ID: ace991be2bcd1d7effbedf0af1d429bdf4611f3656cf906646755a35fb097b4d
Opcode Fuzzy Hash: 269060750e8af1fe3c7ff283836b78ee8bbc06ed8dd7a3853ecdb75b72c88bc2
Instruction Fuzzy Hash: 56329C34A00209AFCB14CF54C899FBEB7F9EF45310F24809EE955AB261D7B4AE81DB51

Function 00C52598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00C52649

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 8313775c7624cd741f75910f0e4aaf880095931ba0415bb040fc788c6867cd18
Instruction ID: 1f0cd2e6f290c82aab112cb0e4e28f8a72ad6df2d48fda263d6198da8b88b521
Opcode Fuzzy Hash: 8313775c7624cd741f75910f0e4aaf880095931ba0415bb040fc788c6867cd18
Instruction Fuzzy Hash: FF21F278200615AFD710DF14C8D0E36B7D9EB56369B5080ACFC668B392CB31EE89CB90

Function 00C513B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00C51420

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: e0ef5a97e13954b3447a22d9484ee9c37e9d005c179516bb2cd73c10765980d4
Instruction ID: 59a4d98244be269cab0cf44ba6e66e9b3454aeaf8c6674a3d6860fa5265c1c85
Opcode Fuzzy Hash: e0ef5a97e13954b3447a22d9484ee9c37e9d005c179516bb2cd73c10765980d4
Instruction Fuzzy Hash: FC319134604202AFD714EF25C495B69B7A1FF45325F0481ADEC294B292DB35EC89CBD4

Function 00BC4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00BC4EDD,?,00C91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BC4E9C
Part of subcall function 00BC4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00BC4EAE
Part of subcall function 00BC4E90: FreeLibrary.KERNEL32(00000000,?,?,00BC4EDD,?,00C91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BC4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00C91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BC4EFD

Part of subcall function 00BC4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00C03CDE,?,00C91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BC4E62
Part of subcall function 00BC4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00BC4E74
Part of subcall function 00BC4E59: FreeLibrary.KERNEL32(00000000,?,?,00C03CDE,?,00C91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BC4E87

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 72c7bd8b4d9d555a3e94d767bebc4234b3f5d75ba39f13c3fd75e72574839db1
Instruction ID: 2a430b21003fa765bb627a0592d16a83c6a881196b11de2244fd7809d1f5093b
Opcode Fuzzy Hash: 72c7bd8b4d9d555a3e94d767bebc4234b3f5d75ba39f13c3fd75e72574839db1
Instruction Fuzzy Hash: 7F110132610305AADB24AB60DC62FED77E5AF50710F20846DF456A61C1EFB0AB449750

Function 00BF8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00BF8440

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 97c71f950aa6eccd80bcf98b22147996c7d3729b5684dd3c9a8c0379523892a4
Instruction ID: 4d6fb0b4e875cc772593316e671d6a29bd6b156eccf57b932f8fec30da1b8c97
Opcode Fuzzy Hash: 97c71f950aa6eccd80bcf98b22147996c7d3729b5684dd3c9a8c0379523892a4
Instruction Fuzzy Hash: FB11487190410AAFCB05DF58E941AAE7BF4FF48300F104099F908AB312DB30DA15CBA4

Function 00BF5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BF4C7D: RtlAllocateHeap.NTDLL(00000008,00BC1129,00000000,?,00BF2E29,00000001,00000364,?,?,?,00BEF2DE,00BF3863,00C91444,?,00BDFDF5,?), ref: 00BF4CBE

_free.LIBCMT ref: 00BF506C

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: ea38449ebfaab7fae8e624da4bddd30a8ae952eb59964c6bdc9fa64da97c58b3
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 95012B722047095BE3318F65988196AFBE8FB85370F25055DE39483280EA706809C674

Function 00C529BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00C514B5,?), ref: 00C52A01

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 09dcc4d64c35a3fa9ad4771a7ee808c377bf76181ce1fa9fd630fb131a679c69
Instruction ID: e04ba7c9b4e86b89e491b569d9f8d69e679c75777779dfe24cd2413720368cb4
Opcode Fuzzy Hash: 09dcc4d64c35a3fa9ad4771a7ee808c377bf76181ce1fa9fd630fb131a679c69
Instruction Fuzzy Hash: 1101B53A300A419FE335CA2DC494B2677D2EBC6316F298468C4578B251D732EDC6D790

Function 00BEE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 01965527788c0dcaf7c356dc428e46df6bc6c2bcc8beb5a87b2433f494c9b851
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: E2F0F432511A58AACA313B6B9C05B6A33D89F52334F100BE5F631932D2DBB0D80986A5

Function 00C5149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 00C514EB

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 66c6569ff3d5514d1d0397cb8eafb6296ecbc806dba0c358c824e343443b589f
Instruction ID: 997aed9148ca77a250b285a3674526e4f3544d3449c2bec86c7995feaa89dfdd
Opcode Fuzzy Hash: 66c6569ff3d5514d1d0397cb8eafb6296ecbc806dba0c358c824e343443b589f
Instruction Fuzzy Hash: 8B01DF393087419F9320CF6AC480A2ABB95FF8536575880ADEC4A8B702D732DDC6CB80

Function 00BF4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00BC1129,00000000,?,00BF2E29,00000001,00000364,?,?,?,00BEF2DE,00BF3863,00C91444,?,00BDFDF5,?), ref: 00BF4CBE

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ff8f9235f794b08e07c7d165f0f257bc9123497d87a0ed24a4c680a95b109755
Instruction ID: f9303b91426692a1dc33f8bb8670675ab6c35c7e8e61f278fa706ce9f15ded19
Opcode Fuzzy Hash: ff8f9235f794b08e07c7d165f0f257bc9123497d87a0ed24a4c680a95b109755
Instruction Fuzzy Hash: C2F0B431602668A6DB215F62AC09B7B37D8FF417A1B145191FB19A7291CB70D80896E0

Function 00BF3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00C91444,?,00BDFDF5,?,?,00BCA976,00000010,00C91440,00BC13FC,?,00BC13C6,?,00BC1129), ref: 00BF3852

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a2da7868490f47fb699fc46325f6c75c7d14cd84671dc38a372d5da0d9cb0c09
Instruction ID: 8fd337b303f3668b79ba913681dd2d2b12d6aad3219083b5924321f8048c6a99
Opcode Fuzzy Hash: a2da7868490f47fb699fc46325f6c75c7d14cd84671dc38a372d5da0d9cb0c09
Instruction Fuzzy Hash: EEE0E53110066DAAD62126779D05BBF37C8EB42FF0F0500A1BE0493590EB19DD0983E0

Function 00BC4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00C91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BC4F6D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 6aab83b5d2ef554eed8d2ba2e3f24f9246f05cada453788329ea9e517ee0067f
Instruction ID: 5938b06450ad45c8e1cfe5cdcde3c7fc7b31ee7baeb4ac45a80552257e7352c0
Opcode Fuzzy Hash: 6aab83b5d2ef554eed8d2ba2e3f24f9246f05cada453788329ea9e517ee0067f
Instruction Fuzzy Hash: 9DF03971105752CFDB349F64D4E0E26BBE4EF143293208ABEE1EE82621CB319984DF10

Function 00C52A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00C52A66

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 06e48f11d796bd46e97862e15bb47961c3bc0e2b483ab93d01f066dfe0fe6864
Instruction ID: ad1b8377a792fc7b274fb9e5a0ffd99d9e01c29039e87ea81a4baf43d79303c8
Opcode Fuzzy Hash: 06e48f11d796bd46e97862e15bb47961c3bc0e2b483ab93d01f066dfe0fe6864
Instruction Fuzzy Hash: B2E04F3A354226AEC714EA31EC809FE739CEB55396B104536FC26D2140DB349AD9A6A4

Function 00BC2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00BC2DC4

Part of subcall function 00BC6B57: _wcslen.LIBCMT ref: 00BC6B6A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 23f791c0fba90695752865d9d72950e4c3cd653a0131825842185b831c912104
Instruction ID: d342f4b6200cc66863d1908b7111751ab791c550f0b0748054478bb92b949a6d
Opcode Fuzzy Hash: 23f791c0fba90695752865d9d72950e4c3cd653a0131825842185b831c912104
Instruction Fuzzy Hash: FCE0C276A002245BCB20E6989C06FEAB7EDDFC8790F0400B5FE09E7248DA60AD80C690

Function 00BC2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BC3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00BC3908

Part of subcall function 00BCD730: GetInputState.USER32 ref: 00BCD807

SetCurrentDirectoryW.KERNEL32(?), ref: 00BC2B6B

Part of subcall function 00BC30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00BC314E

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 6e4df7364f79ac82dfaf9d90fcd05c99fd5165f754a36f15b2cbfa41e72fadfe
Instruction ID: e1ef8c8523f62fc63988b9e390b66e79cf0927797d5b23449ab80ce9ba164d6c
Opcode Fuzzy Hash: 6e4df7364f79ac82dfaf9d90fcd05c99fd5165f754a36f15b2cbfa41e72fadfe
Instruction Fuzzy Hash: E1E0262230034406CA04BB30985AFBDB3C98BD5751F8044BEF14283162CE2449864351

Function 00C23D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C23D18

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 1503e89a16c9d31def3d467fe9cf4c0ed39cbbece1137dc4aca160fe67f29b75
Instruction ID: 10d4f320e39edd80366602ec9d2d52ffb07065f07a98bce1120ea36d5a8380f3
Opcode Fuzzy Hash: 1503e89a16c9d31def3d467fe9cf4c0ed39cbbece1137dc4aca160fe67f29b75
Instruction Fuzzy Hash: B6D012E06A03087EFB0083718C0BEBB329CC316A82F004BA47A02E64C1D9A0DE080130

Function 00C0039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00C00704,?,?,00000000,?,00C00704,00000000,0000000C), ref: 00C003B7

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ee995d1bbe2911b7a91110056240affadf434df8cf9e69d481f73d5c482b5fc7
Instruction ID: 081b320e84c28cf39ff359a4aa8f38013419932ecabbe6ec0cc41fb2a9c9b03a
Opcode Fuzzy Hash: ee995d1bbe2911b7a91110056240affadf434df8cf9e69d481f73d5c482b5fc7
Instruction Fuzzy Hash: 84D06C3204020DBFDF028F84DD46EDE3BAAFB48714F014000BE1866020C732E861AB90

Function 00BC1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00BC1CBC

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 7ffdf63db01a44fe4f56fdd95e1bcc4704cbd7215cbf388e91b8fb6065e5bd2c
Instruction ID: da17c6d0c87c7babdc2c68a692353776e5e3acd62e1d23e15e322f581553ac52
Opcode Fuzzy Hash: 7ffdf63db01a44fe4f56fdd95e1bcc4704cbd7215cbf388e91b8fb6065e5bd2c
Instruction Fuzzy Hash: BEC09B39280305AFF2144BD0BC4FF187764B348B01F444002F64D655F3D3B15850F650

Non-executed Functions

Function 00C59576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BD9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00C5961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C5965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00C5969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C596C9
SendMessageW.USER32 ref: 00C596F2
GetKeyState.USER32(00000011), ref: 00C5978B
GetKeyState.USER32(00000009), ref: 00C59798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C597AE
GetKeyState.USER32(00000010), ref: 00C597B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C597E9
SendMessageW.USER32 ref: 00C59810
SendMessageW.USER32(?,00001030,?,00C57E95), ref: 00C59918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00C5992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00C59941
SetCapture.USER32(?), ref: 00C5994A
ClientToScreen.USER32(?,?), ref: 00C599AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00C599BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C599D6
ReleaseCapture.USER32 ref: 00C599E1
GetCursorPos.USER32(?), ref: 00C59A19
ScreenToClient.USER32(?,?), ref: 00C59A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C59A80
SendMessageW.USER32 ref: 00C59AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C59AEB
SendMessageW.USER32 ref: 00C59B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00C59B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00C59B4A
GetCursorPos.USER32(?), ref: 00C59B68
ScreenToClient.USER32(?,?), ref: 00C59B75
GetParent.USER32(?), ref: 00C59B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C59BFA
SendMessageW.USER32 ref: 00C59C2B
ClientToScreen.USER32(?,?), ref: 00C59C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00C59CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C59CDE
SendMessageW.USER32 ref: 00C59D01
ClientToScreen.USER32(?,?), ref: 00C59D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00C59D82

Part of subcall function 00BD9944: GetWindowLongW.USER32(?,000000EB), ref: 00BD9952

GetWindowLongW.USER32(?,000000F0), ref: 00C59E05

Strings

@U=u, xrefs: 00C5965B, 00C596C9, 00C596F2, 00C597AE, 00C597E9, 00C59810, 00C59918, 00C59A80, 00C59AAE, 00C59AEB, 00C59B1A, 00C59BFA, 00C59C2B, 00C59CDE, 00C59D01
@GUI_DRAGID, xrefs: 00C5997D
F, xrefs: 00C59D07

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$@U=u$F
API String ID: 3429851547-1007936534
Opcode ID: efb9a8aa8373a5f90818703ae4a86169e0a9fe96664e38b5b5ab055c8e42264e
Instruction ID: 7f2f997ae3c8068b91c7cb45f0fca4792cdbdc058480e93d99b9efebc82ff2a5
Opcode Fuzzy Hash: efb9a8aa8373a5f90818703ae4a86169e0a9fe96664e38b5b5ab055c8e42264e
Instruction Fuzzy Hash: 1B429F38204341EFDB21CF24CD84BAABBF5FF48311F140699F969972A1DB31A998DB45

Function 00C54873 Relevance: 61.8, APIs: 33, Strings: 2, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00C548F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00C54908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00C54927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00C5494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00C5495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00C5497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00C549AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00C549D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00C54A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00C54A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00C54A7E
IsMenu.USER32(?), ref: 00C54A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C54AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C54B20
GetWindowLongW.USER32(?,000000F0), ref: 00C54B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00C54BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00C54C82
wsprintfW.USER32 ref: 00C54CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C54CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00C54CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00C54D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C54D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00C54D5A

Strings

%d/%02d/%02d, xrefs: 00C54CA8
@U=u, xrefs: 00C548F3, 00C54908, 00C5495C, 00C54A0F, 00C54A56, 00C54A7E, 00C54BE3, 00C54C82, 00C54CC9, 00C54D13, 00C54D33, 00C54E15, 00C54E4E, 00C54EA5, 00C54F10

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d$@U=u
API String ID: 4054740463-2764005415
Opcode ID: 2b9b6d852bbf0e973c2221a333723e9f6055b778d9856a5db6d3df438ff1524a
Instruction ID: 79c9a7d8473d6af7cc52df51cacdfd9739d93dc055c4216380cdc610cee4773a
Opcode Fuzzy Hash: 2b9b6d852bbf0e973c2221a333723e9f6055b778d9856a5db6d3df438ff1524a
Instruction Fuzzy Hash: 4812D139500304ABEB288F69CC49FAE7BF8EB45315F104269F925EA2D1DB749AC4CB54

Function 00BDF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00BDF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C1F474
IsIconic.USER32(00000000), ref: 00C1F47D
ShowWindow.USER32(00000000,00000009), ref: 00C1F48A
SetForegroundWindow.USER32(00000000), ref: 00C1F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00C1F4AA
GetCurrentThreadId.KERNEL32 ref: 00C1F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00C1F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00C1F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00C1F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00C1F4DE
SetForegroundWindow.USER32(00000000), ref: 00C1F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C1F4F6
keybd_event.USER32(00000012,00000000), ref: 00C1F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C1F50B
keybd_event.USER32(00000012,00000000), ref: 00C1F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C1F519
keybd_event.USER32(00000012,00000000), ref: 00C1F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C1F528
keybd_event.USER32(00000012,00000000), ref: 00C1F52D
SetForegroundWindow.USER32(00000000), ref: 00C1F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00C1F557

Strings

Shell_TrayWnd, xrefs: 00C1F46F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 766aca4b8613c05e9f53bdb4ae907571550a0cde90051d3408959251b87c5e99
Instruction ID: 2afcab340994743accc38716335e84542830dd5d4d57e18819408513597f2b79
Opcode Fuzzy Hash: 766aca4b8613c05e9f53bdb4ae907571550a0cde90051d3408959251b87c5e99
Instruction Fuzzy Hash: 85319475A40318BFEB216BB54C8AFBF7E6DEB44B51F100069F601F61D1D6B05E81BA60

Function 00C21201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00C216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C2170D
Part of subcall function 00C216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C2173A
Part of subcall function 00C216C3: GetLastError.KERNEL32 ref: 00C2174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00C21286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00C212A8
CloseHandle.KERNEL32(?), ref: 00C212B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00C212D1
GetProcessWindowStation.USER32 ref: 00C212EA
SetProcessWindowStation.USER32(00000000), ref: 00C212F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00C21310

Part of subcall function 00C210BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C211FC), ref: 00C210D4
Part of subcall function 00C210BF: CloseHandle.KERNEL32(?,?,00C211FC), ref: 00C210E9

Strings

default, xrefs: 00C2130B
winsta0, xrefs: 00C212CC
, xrefs: 00C2125A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 2532b0e6977e723905f96b79d9778cd6d5858be539663833b5b8ce6f078fe354
Instruction ID: bb02efc453afbfdaefe280b2a7b1d4f6ec96a8e57d4ec3ee64aae26c3064d31b
Opcode Fuzzy Hash: 2532b0e6977e723905f96b79d9778cd6d5858be539663833b5b8ce6f078fe354
Instruction Fuzzy Hash: A5819F71900319AFDF109FA5EC89BEE7BB9EF04704F184129FD25B65A0D7718A84CB60

Function 00C20B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C21114
Part of subcall function 00C210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00C20B9B,?,?,?), ref: 00C21120
Part of subcall function 00C210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00C20B9B,?,?,?), ref: 00C2112F
Part of subcall function 00C210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00C20B9B,?,?,?), ref: 00C21136
Part of subcall function 00C210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C2114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00C20BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00C20C00
GetLengthSid.ADVAPI32(?), ref: 00C20C17
GetAce.ADVAPI32(?,00000000,?), ref: 00C20C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00C20C6D
GetLengthSid.ADVAPI32(?), ref: 00C20C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00C20C8C
HeapAlloc.KERNEL32(00000000), ref: 00C20C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00C20CB4
CopySid.ADVAPI32(00000000), ref: 00C20CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00C20CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C20D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00C20D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C20D45
HeapFree.KERNEL32(00000000), ref: 00C20D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C20D55
HeapFree.KERNEL32(00000000), ref: 00C20D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C20D65
HeapFree.KERNEL32(00000000), ref: 00C20D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00C20D78
HeapFree.KERNEL32(00000000), ref: 00C20D7F

Part of subcall function 00C21193: GetProcessHeap.KERNEL32(00000008,00C20BB1,?,00000000,?,00C20BB1,?), ref: 00C211A1
Part of subcall function 00C21193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00C20BB1,?), ref: 00C211A8
Part of subcall function 00C21193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00C20BB1,?), ref: 00C211B7

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: cd1a80e9a197b60b2ee45523dadb91835b7132bd6b4587869714378e2e246cd3
Instruction ID: 23a0b2edf0cd7615d4df6b02b665079551d0959666da3eded3d8b0c8e45c03fe
Opcode Fuzzy Hash: cd1a80e9a197b60b2ee45523dadb91835b7132bd6b4587869714378e2e246cd3
Instruction Fuzzy Hash: FE715C7590131AAFDF10DFA4EC84BAEBBB8FF04311F14451AE914B6192D771AA45CF60

Function 00C3EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00C5CC08), ref: 00C3EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00C3EB37
GetClipboardData.USER32(0000000D), ref: 00C3EB43
CloseClipboard.USER32 ref: 00C3EB4F
GlobalLock.KERNEL32(00000000), ref: 00C3EB87
CloseClipboard.USER32 ref: 00C3EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00C3EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00C3EBC9
GetClipboardData.USER32(00000001), ref: 00C3EBD1
GlobalLock.KERNEL32(00000000), ref: 00C3EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00C3EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00C3EC38
GetClipboardData.USER32(0000000F), ref: 00C3EC44
GlobalLock.KERNEL32(00000000), ref: 00C3EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00C3EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00C3EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00C3ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00C3ECF3
CountClipboardFormats.USER32 ref: 00C3ED14
CloseClipboard.USER32 ref: 00C3ED59

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: eeab7e25bf83b70700811f96e9d9dbe32f2b3a1a11fb2a996c47c938cd06bd90
Instruction ID: 861e79384d9d89123bd976dccc482998717cabfefc98ba3c6baf718f36c27892
Opcode Fuzzy Hash: eeab7e25bf83b70700811f96e9d9dbe32f2b3a1a11fb2a996c47c938cd06bd90
Instruction Fuzzy Hash: B8619B382043019FD300EF24D899F6AB7E4AF84704F14455DF466AB2E2CB71DA45CBA2

Function 00C3698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C369BE
FindClose.KERNEL32(00000000), ref: 00C36A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C36A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C36A75

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00C36AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00C36ADF

Strings

%4d, xrefs: 00C36BB1
%03d, xrefs: 00C36DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00C36B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00C36B32
%02d, xrefs: 00C36C00, 00C36C0A, 00C36C5A, 00C36CAA, 00C36CFA, 00C36D4A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: c27cb84dfc42b00ab61df333fb4d3dca11b0d2ef44afa92e224202cf49f3b78f
Instruction ID: 547abcd08100c5fa993541966616ac28ed5ec25cbeb395d0acc12d3bfe849d95
Opcode Fuzzy Hash: c27cb84dfc42b00ab61df333fb4d3dca11b0d2ef44afa92e224202cf49f3b78f
Instruction Fuzzy Hash: DFD15072508300AFC310EBA4C885EAFB7ECAF98704F04495DF599D7291EB74DA48CB62

Function 00C39642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 00C39663
GetFileAttributesW.KERNEL32(?), ref: 00C396A1
SetFileAttributesW.KERNEL32(?,?), ref: 00C396BB
FindNextFileW.KERNEL32(00000000,?), ref: 00C396D3
FindClose.KERNEL32(00000000), ref: 00C396DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00C396FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00C3974A
SetCurrentDirectoryW.KERNEL32(00C86B7C), ref: 00C39768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C39772
FindClose.KERNEL32(00000000), ref: 00C3977F
FindClose.KERNEL32(00000000), ref: 00C3978F

Strings

*.*, xrefs: 00C396F5

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 42d3817699dd792e49bd2e065b81745b6d4c32e4bea08109284b9ad5641d3cab
Instruction ID: 4b81ec8c019f5caa27b3da6f0dfabbda9f2e21842d6a413913893bbe611d9d7e
Opcode Fuzzy Hash: 42d3817699dd792e49bd2e065b81745b6d4c32e4bea08109284b9ad5641d3cab
Instruction Fuzzy Hash: D131F33655131A6FDB20AFB4DC89BEE77ACDF0A326F104065F915E20E0DB74DE848A14

Function 00C3979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 00C397BE
FindNextFileW.KERNEL32(00000000,?), ref: 00C39819
FindClose.KERNEL32(00000000), ref: 00C39824
FindFirstFileW.KERNEL32(*.*,?), ref: 00C39840
SetCurrentDirectoryW.KERNEL32(?), ref: 00C39890
SetCurrentDirectoryW.KERNEL32(00C86B7C), ref: 00C398AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C398B8
FindClose.KERNEL32(00000000), ref: 00C398C5
FindClose.KERNEL32(00000000), ref: 00C398D5

Part of subcall function 00C2DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00C2DB00

Strings

*.*, xrefs: 00C3983B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: ce25cf69b1a24f8f891eca1fbf9065439ffa4920cc0ae0ac141f3049dea41924
Instruction ID: c4de5baec7b6796fe1f63c9b234056274ed46ce7b933b074c3a26d50b370b2c6
Opcode Fuzzy Hash: ce25cf69b1a24f8f891eca1fbf9065439ffa4920cc0ae0ac141f3049dea41924
Instruction Fuzzy Hash: 0831B33551031A6FDB20AFA5DC88BDEB7ACDF46325F104165E920B20E0DB70DE84CB65

Function 00C4BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C4B6AE,?,?), ref: 00C4C9B5
Part of subcall function 00C4C998: _wcslen.LIBCMT ref: 00C4C9F1
Part of subcall function 00C4C998: _wcslen.LIBCMT ref: 00C4CA68
Part of subcall function 00C4C998: _wcslen.LIBCMT ref: 00C4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C4BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00C4BFA9
RegCloseKey.ADVAPI32(00000000), ref: 00C4BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00C4C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00C4C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00C4C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00C4C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00C4C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00C4C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00C4C382
RegCloseKey.ADVAPI32(00000000), ref: 00C4C38F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: d9c40863ab5b9641428bb32344221653bd2b939e39367af6dbdbd0c8aa9a8e80
Instruction ID: e2ad20128d0cd5cbf3928dd14c46361a1f443d244c3f83558f4ab56430967863
Opcode Fuzzy Hash: d9c40863ab5b9641428bb32344221653bd2b939e39367af6dbdbd0c8aa9a8e80
Instruction Fuzzy Hash: 00024971604200AFD754CF28C8D5E2ABBE5FF89318F18849DF85A9B2A2DB31ED45CB51

Function 00C38195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00C38257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00C38267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00C38273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C38310
SetCurrentDirectoryW.KERNEL32(?), ref: 00C38324
SetCurrentDirectoryW.KERNEL32(?), ref: 00C38356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00C3838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00C38395

Strings

*.*, xrefs: 00C3839B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 958a6e1537968d3b20b1c66ff7d9fe429bfd9fbacfb90587a7de93fc24de9821
Instruction ID: cc289d7727947527c93305b4736914f0cca7071e67f0fd3e13167d40480507a9
Opcode Fuzzy Hash: 958a6e1537968d3b20b1c66ff7d9fe429bfd9fbacfb90587a7de93fc24de9821
Instruction Fuzzy Hash: 0A618B725143059FC710EF60C880EAEB3E8FF89310F04496DF99997251DB31EA49CB92

Function 00C2D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BC3A97,?,?,00BC2E7F,?,?,?,00000000), ref: 00BC3AC2

Part of subcall function 00C2E199: GetFileAttributesW.KERNEL32(?,00C2CF95), ref: 00C2E19A

FindFirstFileW.KERNEL32(?,?), ref: 00C2D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00C2D1DD
MoveFileW.KERNEL32(?,?), ref: 00C2D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00C2D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C2D237

Part of subcall function 00C2D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00C2D21C,?,?), ref: 00C2D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00C2D253
FindClose.KERNEL32(00000000), ref: 00C2D264

Strings

\*.*, xrefs: 00C2D0CD, 00C2D0D6, 00C2D0EB

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 07fca15355b214dedb14133e3a7864737fe74e0833df991e73fe29ff4627caa8
Instruction ID: 981c715fecd15b2a59bc43e23f2a2fc43c9f8eb8a318c11e9d3bd8071084ac7d
Opcode Fuzzy Hash: 07fca15355b214dedb14133e3a7864737fe74e0833df991e73fe29ff4627caa8
Instruction Fuzzy Hash: 9D615E3180121D9ECF05EBE0E992EEDB7B5AF65300F2441A9E41277192EB306F09DB61

Function 00C3ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00C3ED91
EmptyClipboard.USER32 ref: 00C3ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00C3EDAC
CloseClipboard.USER32 ref: 00C3EEA3

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d36cbf08a428cc685500f18b39be50ce5da31c3eaa3b4924805004537d5838f5
Instruction ID: bfb298014112babf20f0be075c56225f4b9d939a87bdc9b3099f6811a498b15c
Opcode Fuzzy Hash: d36cbf08a428cc685500f18b39be50ce5da31c3eaa3b4924805004537d5838f5
Instruction Fuzzy Hash: 49419F35214611AFD710DF15D889F1ABBE5FF44319F14C09DE4299B6A2CB35EE82CB90

Function 00C2E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00C216C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C2170D
Part of subcall function 00C216C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C2173A
Part of subcall function 00C216C3: GetLastError.KERNEL32 ref: 00C2174A

ExitWindowsEx.USER32(?,00000000), ref: 00C2E932

Strings

, xrefs: 00C2E95C
, xrefs: 00C2E920
SeShutdownPrivilege, xrefs: 00C2E902
@, xrefs: 00C2E925

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 28eec787261f9a7f338d9c3a7920f8b995bdf964b6108de28fb9de991d529b0f
Instruction ID: 47420c86747fa47b030dc87e349fe6c602f502cfe8b6b6e2cd7ad43fd0b999c4
Opcode Fuzzy Hash: 28eec787261f9a7f338d9c3a7920f8b995bdf964b6108de28fb9de991d529b0f
Instruction Fuzzy Hash: 9D01A272610331AFEB5436B5BC8ABFF725C9714751F190422FC12F25D1D5A05DC49294

Function 00C41204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00C41276
WSAGetLastError.WSOCK32 ref: 00C41283
bind.WSOCK32(00000000,?,00000010), ref: 00C412BA
WSAGetLastError.WSOCK32 ref: 00C412C5
closesocket.WSOCK32(00000000), ref: 00C412F4
listen.WSOCK32(00000000,00000005), ref: 00C41303
WSAGetLastError.WSOCK32 ref: 00C4130D
closesocket.WSOCK32(00000000), ref: 00C4133C

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: d4e9001c15e3346c8f61d08c9df2eccfd72abf658985acfb7ee2dbe824e4ad67
Instruction ID: bb676cd30ba9c90be29f2ef96c9a9d298f3924e1cdf0447156b785c86d53b6ac
Opcode Fuzzy Hash: d4e9001c15e3346c8f61d08c9df2eccfd72abf658985acfb7ee2dbe824e4ad67
Instruction Fuzzy Hash: 5C416F356002409FD720DF64C485B29BBE5BF46318F188198D8669F2E2C771EDC5CBA1

Function 00BFB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BFB9D4
_free.LIBCMT ref: 00BFB9F8
_free.LIBCMT ref: 00BFBB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00C63700), ref: 00BFBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00C9121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00BFBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00C91270,000000FF,?,0000003F,00000000,?), ref: 00BFBC36
_free.LIBCMT ref: 00BFBD4B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 46120b21fc809089f5cccb06844e63dbe42c9e41a932b4a243a979c075b5a6fa
Instruction ID: cd3d7f57f2ba7372e9300467e16d203119cb02f261c349d9181f02870419e059
Opcode Fuzzy Hash: 46120b21fc809089f5cccb06844e63dbe42c9e41a932b4a243a979c075b5a6fa
Instruction Fuzzy Hash: 31C1067190420DAFCB24AF69DC41FBE7BE8EF41350F1841EAEA94D7252EB309E498750

Function 00C2D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BC3A97,?,?,00BC2E7F,?,?,?,00000000), ref: 00BC3AC2

Part of subcall function 00C2E199: GetFileAttributesW.KERNEL32(?,00C2CF95), ref: 00C2E19A

FindFirstFileW.KERNEL32(?,?), ref: 00C2D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00C2D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C2D481
FindClose.KERNEL32(00000000), ref: 00C2D498
FindClose.KERNEL32(00000000), ref: 00C2D4A1

Strings

\*.*, xrefs: 00C2D3F2

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 0b455083866eaf186e4f8369e089eab7986ab3d9cc0417f5ccc155355f2b32e4
Instruction ID: 78a35831adba88ea704529e1cb11ae6fc1a576cb1dc1391936e134e1c778695e
Opcode Fuzzy Hash: 0b455083866eaf186e4f8369e089eab7986ab3d9cc0417f5ccc155355f2b32e4
Instruction Fuzzy Hash: 683170310083559FC304FF64D895EAF77E8AEA5304F444A5DF4D263191EB30AA09CB67

Function 00BFE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00BFE645

Strings

1#IND, xrefs: 00BFF83D
1#SNAN, xrefs: 00BFF844
1#QNAN, xrefs: 00BFF84B
1#INF, xrefs: 00BFF852

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 1bdeb2861e4b15d592906d21172b12e627db6d1ebe6b6f285290b2169293afee
Instruction ID: d53636fdfd46708970b548eb9940b6f1b459210dca4f9922d54ef4f934b1e7c4
Opcode Fuzzy Hash: 1bdeb2861e4b15d592906d21172b12e627db6d1ebe6b6f285290b2169293afee
Instruction Fuzzy Hash: CDC23771E086298BDB25CE289D807BAB7F5EF48304F1441EAD91DE7250E774AE898F40

Function 00C3648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C364DC
CoInitialize.OLE32(00000000), ref: 00C36639
CoCreateInstance.OLE32(00C5FCF8,00000000,00000001,00C5FB68,?), ref: 00C36650
CoUninitialize.OLE32 ref: 00C368D4

Strings

.lnk, xrefs: 00C364BA, 00C36524, 00C365E0

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: d7eea6a01cc1ebf96f95b92c6109fa861f959e361bb69cd833743df0978ad4f7
Instruction ID: 028f0e7a13b0cfbadd54da78597488dd6c3e9489969e47c7842e404cb2f85943
Opcode Fuzzy Hash: d7eea6a01cc1ebf96f95b92c6109fa861f959e361bb69cd833743df0978ad4f7
Instruction Fuzzy Hash: 22D13A71518301AFD314EF24C881E6BB7E9FF98704F00896DF5958B291DB71EA49CBA2

Function 00C422DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00C422E8

Part of subcall function 00C3E4EC: GetWindowRect.USER32(?,?), ref: 00C3E504

GetDesktopWindow.USER32 ref: 00C42312
GetWindowRect.USER32(00000000), ref: 00C42319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00C42355
GetCursorPos.USER32(?), ref: 00C42381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00C423DF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 0f9affbb6552cc01847cf28d413bef5b8a7d866bf787dd394595cdc36f3d6351
Instruction ID: 672f213399b1851e0e4fe8cf61beaced62dc45466df5b6079991c4af4083619c
Opcode Fuzzy Hash: 0f9affbb6552cc01847cf28d413bef5b8a7d866bf787dd394595cdc36f3d6351
Instruction Fuzzy Hash: F431FC72504315AFC720DF54D84AF9BBBADFF88314F400A1AF894A7191DB34EA48CB92

Function 00C39B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00C39B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00C39C8B

Part of subcall function 00C33874: GetInputState.USER32 ref: 00C338CB
Part of subcall function 00C33874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C33966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00C39BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00C39C75

Strings

*.*, xrefs: 00C39B5D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 4a16486d2c1373d74132161027bff01fcf386ee23432c23a939c1e2d46672fb9
Instruction ID: 75f21acaa4ed74071517835c6f14a3461f3d6c4294b66424d183db642bb78711
Opcode Fuzzy Hash: 4a16486d2c1373d74132161027bff01fcf386ee23432c23a939c1e2d46672fb9
Instruction Fuzzy Hash: 0441AF7191420A9FCF14DFA4D889BEEBBF8EF05305F24419AE815A2191EB709F84CF64

Function 00BD997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00BD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BD9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00BD9A4E
GetSysColor.USER32(0000000F), ref: 00BD9B23
SetBkColor.GDI32(?,00000000), ref: 00BD9B36

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: f443dcf888aec76d06152f06f09b9d2a48f314e6b9f112d3bf22e1d459ad08c5
Instruction ID: 5f143e6ad92e2363d5081d240a42ba2edac7176d0221ad53bc023aefda25e9c0
Opcode Fuzzy Hash: f443dcf888aec76d06152f06f09b9d2a48f314e6b9f112d3bf22e1d459ad08c5
Instruction Fuzzy Hash: 2CA13971108504EEE729AA3C8C9DEBF6AEDDB43340F15038BF412D67D1EA259E81E275

Function 00C41806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00C4307A
Part of subcall function 00C4304E: _wcslen.LIBCMT ref: 00C4309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00C4185D
WSAGetLastError.WSOCK32 ref: 00C41884
bind.WSOCK32(00000000,?,00000010), ref: 00C418DB
WSAGetLastError.WSOCK32 ref: 00C418E6
closesocket.WSOCK32(00000000), ref: 00C41915

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 468266aa978f1849fb8f8ed1a50821caa90e73eb840b8b9c5f97efc23b9114ed
Instruction ID: f416d72c881321e6c0986942060a017690eab0693ddd40b3d42c4750d78388cf
Opcode Fuzzy Hash: 468266aa978f1849fb8f8ed1a50821caa90e73eb840b8b9c5f97efc23b9114ed
Instruction Fuzzy Hash: 5D51A775A002105FD710AF24C886F6A77E5EB44718F18849CF95A6F3D3D771AD81CBA1

Function 00C51C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00C51CC0
IsWindowEnabled.USER32 ref: 00C51CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00C51CDB
IsIconic.USER32 ref: 00C51CE9
IsZoomed.USER32 ref: 00C51CF7

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 596fdb01fdb1d297a8959498fb4fc9bbbfd69e212d6d7b390c588b6d78e6e582
Instruction ID: 0abd06fcb97aad3440412c13d032405e736610304b60521d03fbfeba0abfdd23
Opcode Fuzzy Hash: 596fdb01fdb1d297a8959498fb4fc9bbbfd69e212d6d7b390c588b6d78e6e582
Instruction Fuzzy Hash: 8D21B4397402105FD7218F1AC888F2A7BE5EF95316B1C805CEC5A9B351CB72ED86CB98

Function 00BC8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00C05DF0
ERCP, xrefs: 00BC813C
VUUU, xrefs: 00BC843C
VUUU, xrefs: 00BC83FA
VUUU, xrefs: 00BC83E8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 9afbc69ac84e2d9ba7dc0bbd26f9c405e96799e93085c1de1ead85e37b797acc
Instruction ID: 4871953053525af58a2dfc04e185d54d5b7173bad5ffc0ee221cd5f5ac8d59de
Opcode Fuzzy Hash: 9afbc69ac84e2d9ba7dc0bbd26f9c405e96799e93085c1de1ead85e37b797acc
Instruction Fuzzy Hash: C4A26070E0061ACBDF24CF58C984BAEB7B1FF54314F2481AAD865A7285DB749E91CF90

Function 00C4A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C4A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00C4A6BA

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

Process32NextW.KERNEL32(00000000,?), ref: 00C4A79C
CloseHandle.KERNEL32(00000000), ref: 00C4A7AB

Part of subcall function 00BDCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00C03303,?), ref: 00BDCE8A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 456858a8ad66cbf3a9504dcd9d60ec1af9f67da46d40e79134efee73bac35051
Instruction ID: 0a00afbdcd68777b37091993aa5a0863a5f50ead9234d5b4fd97347218b101a0
Opcode Fuzzy Hash: 456858a8ad66cbf3a9504dcd9d60ec1af9f67da46d40e79134efee73bac35051
Instruction Fuzzy Hash: 2A511871508300AFD710EF24C886E6BBBE8FF89754F40496DF599972A1EB30D945CBA2

Function 00C2AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00C2AAAC
SetKeyboardState.USER32(00000080), ref: 00C2AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00C2AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00C2AB88

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 050c4bd125af0825a86d56bfbad3a41cfc1cf6588933b1e52f928026f3e6ab21
Instruction ID: 5afa6ee0cc81e101b7c86daea6b2d944ea8551e9446c0dd1b2a51132a621ff69
Opcode Fuzzy Hash: 050c4bd125af0825a86d56bfbad3a41cfc1cf6588933b1e52f928026f3e6ab21
Instruction Fuzzy Hash: 65312A70A40328AFFF35CB65EC05BFE7BA6AF44310F04421AF191569D0D7758A85DB62

Function 00C3CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00C3CE89
GetLastError.KERNEL32(?,00000000), ref: 00C3CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00C3CEFE

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 7a7eaa3280bdd5551240f2be8522002198fd66d0c325aea2505de11a068d8b9b
Instruction ID: 87b40fc5766b33e87546222c24794718a2a62af4fb549c0b571184194e4eb87c
Opcode Fuzzy Hash: 7a7eaa3280bdd5551240f2be8522002198fd66d0c325aea2505de11a068d8b9b
Instruction Fuzzy Hash: C521BD715103059FD720DFA6C988BAA77F8EB10358F10441EE556A2151E770EE448B50

Function 00C28298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00C282AA

Strings

|, xrefs: 00C282DA
(, xrefs: 00C282F0

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: ae3208d4d350bb9a7119cbe496cf45432b5572eb5daf7e08da39e53fb6122466
Instruction ID: c498c8ff5c9f00aafb4d9ef0fc8b53824bbb4b291c6a06c0803e3d6de3cc7031
Opcode Fuzzy Hash: ae3208d4d350bb9a7119cbe496cf45432b5572eb5daf7e08da39e53fb6122466
Instruction Fuzzy Hash: B3323474A017159FCB28CF19D480A6AB7F0FF48710B15C46EE5AADB7A1EB70E981CB40

Function 00C35C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C35CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00C35D17
FindClose.KERNEL32(?), ref: 00C35D5F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: e4c69d8c74d7b2bd4c23f2e3efb488324f9a602098a1be0327d8c17908b33e7a
Instruction ID: 8c86d08eaec0804f0740d93ac796449f56c58d6fe2981e724c7cafeda73faa14
Opcode Fuzzy Hash: e4c69d8c74d7b2bd4c23f2e3efb488324f9a602098a1be0327d8c17908b33e7a
Instruction Fuzzy Hash: CD518874604B019FC714DF28C494E9AB7E4FF49314F14859EE96A8B3A1CB30ED45CB91

Function 00BF2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00BF271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BF2724
UnhandledExceptionFilter.KERNEL32(?), ref: 00BF2731

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f9dc6d17ed0e743a765bcc67ce64fbd680463e2c8b851b9778b6527c0a24483b
Instruction ID: 7cbf38b0659f5268c967a24261cd0af08afa3610d97e65b0bba150b1cc5b7236
Opcode Fuzzy Hash: f9dc6d17ed0e743a765bcc67ce64fbd680463e2c8b851b9778b6527c0a24483b
Instruction Fuzzy Hash: A731A17491131CABCB21DF69D88979DBBB8AF08310F5041EAE81CA7261E7709F858F45

Function 00C351CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C351DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00C35238
SetErrorMode.KERNEL32(00000000), ref: 00C352A1

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 6879d73a83c7e84a87aac1a178cc22f1f76b4a7545ed043acdf7583be3781bcf
Instruction ID: ff5400dd9a77b3f2fc88be7de1743766d46a1c5be82d3cace058b0b91ed0ec43
Opcode Fuzzy Hash: 6879d73a83c7e84a87aac1a178cc22f1f76b4a7545ed043acdf7583be3781bcf
Instruction Fuzzy Hash: 03312D75A106189FDB00DF54D884FAEBBF4FF49314F048099E809AB352DB32E956CB90

Function 00C216C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00BDFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00BE0668
Part of subcall function 00BDFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00BE0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C2170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C2173A
GetLastError.KERNEL32 ref: 00C2174A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 749aa7a2be12e032005842f1d176e81e70c4063238c0bc7f5ebabe4499c4accd
Instruction ID: a0d52dd8f22154f4cfa5d3a1c9672eb14ff1ed3027ec652ca5c16c7d4b9d2b09
Opcode Fuzzy Hash: 749aa7a2be12e032005842f1d176e81e70c4063238c0bc7f5ebabe4499c4accd
Instruction Fuzzy Hash: 8011C1B2404305AFD7189F54ECC6E6FB7F9EB44B24B24852EF45653641EB70BC818A20

Function 00C2D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00C2D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00C2D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00C2D650

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 9e0228c6e82184be0363e960281b526f0d10ea0ae4d6ebd4750edd2e7e63ae4c
Instruction ID: bd3f2cb0888c974ce1f7082d9a53225b46a8cc1f2b983d581d5fb98746cde45c
Opcode Fuzzy Hash: 9e0228c6e82184be0363e960281b526f0d10ea0ae4d6ebd4750edd2e7e63ae4c
Instruction Fuzzy Hash: 0A117C75E01328BFDB108F95AC84FAFBBBCEB45B60F108111F914E7290C2704A018BA1

Function 00C21663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00C2168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00C216A1
FreeSid.ADVAPI32(?), ref: 00C216B1

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 5d7db418442fde5098e109ce1ab990cb5e3e2a645595cca56fa268c35c37ff80
Instruction ID: 6f85e52d48d468635d80bced6899b5c14eff722135c47ab200818e8ad7320a3a
Opcode Fuzzy Hash: 5d7db418442fde5098e109ce1ab990cb5e3e2a645595cca56fa268c35c37ff80
Instruction Fuzzy Hash: DBF0F475950309FFDB00DFE4DC89AAEBBBCEB08605F504565E901E2181E774AA848A50

Function 00BE4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00BF28E9,?,00BE4CBE,00BF28E9,00C888B8,0000000C,00BE4E15,00BF28E9,00000002,00000000,?,00BF28E9), ref: 00BE4D09
TerminateProcess.KERNEL32(00000000,?,00BE4CBE,00BF28E9,00C888B8,0000000C,00BE4E15,00BF28E9,00000002,00000000,?,00BF28E9), ref: 00BE4D10
ExitProcess.KERNEL32 ref: 00BE4D22

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a4a5c05c18c90e8cd689e4c02738504e2530045ba4a22624b0a43447caafd4ad
Instruction ID: 6f9a98f6fa790a3cdf8f2d1a533f0fb4a9874f828cbe8afd5fa471a9bc6042b7
Opcode Fuzzy Hash: a4a5c05c18c90e8cd689e4c02738504e2530045ba4a22624b0a43447caafd4ad
Instruction Fuzzy Hash: ABE09235000688AFCB11AF55DD49B993BA9EF82792B1080A4F9059A232CB35DD82CA80

Function 00BFC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00BFC36C

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 0ecfa1357f5749079199fd3be627943689000efd1816190434b4d046e021ee99
Instruction ID: 67ad719d637a81fd0e07dee17b01c0d253ddf39ccc8b77a38ef1446fee6654fa
Opcode Fuzzy Hash: 0ecfa1357f5749079199fd3be627943689000efd1816190434b4d046e021ee99
Instruction Fuzzy Hash: 0741387690021DAFCB209FB9CD88EBB7BF8EB84354F1042A9FA05D7180E6709D848B54

Function 00C1D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00C1D28C

Strings

X64, xrefs: 00C1D2A8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 592915ea11312e5c3c1bdd18dd8fd4b24c6a07a83cd052fd8debfd2e1baa7718
Instruction ID: 50a0dcf3d39173fb06e3065b21351deee56f53551b15bd00a2e7bf7fc5f1d351
Opcode Fuzzy Hash: 592915ea11312e5c3c1bdd18dd8fd4b24c6a07a83cd052fd8debfd2e1baa7718
Instruction Fuzzy Hash: E4D0C9B480121DEECF90CB90DCC8EDDB7BCBB04305F100192F106A2140D77495889F10

Function 00BECAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 62bfbd1fe0e9606c91cf5913930393d038eeb4f1cb31bda015204260f1f66d77
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 67021C71E002599BDF14CFA9C8806ADFBF1EF48314F2581A9E919E7384D731AA46CB94

Function 00C368EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C36918
FindClose.KERNEL32(00000000), ref: 00C36961

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 444e39baf8f68685dba7b15baa1e806db106480a01f0c724c5a50b9feec8ca2d
Instruction ID: b123d6fababf3e0cf6c19a432fbe4d1b39964a6fd0bbfe2f7583c3305264cce4
Opcode Fuzzy Hash: 444e39baf8f68685dba7b15baa1e806db106480a01f0c724c5a50b9feec8ca2d
Instruction Fuzzy Hash: 7C118E35614300AFC710DF29D884B1ABBE5EF85329F14C69DE4699F6A2CB30EC45CB91

Function 00C337B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00C44891,?,?,00000035,?), ref: 00C337E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00C44891,?,?,00000035,?), ref: 00C337F4

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: d459654ba1e9923921c91e9b519dfd07c53d382150f2d434dc7b2962431a1706
Instruction ID: 6e7cee4abd9aba4537cc45ac8b5e83390537fc0a0b3d99cb2a7d8f92d8bc3502
Opcode Fuzzy Hash: d459654ba1e9923921c91e9b519dfd07c53d382150f2d434dc7b2962431a1706
Instruction Fuzzy Hash: 74F0E5B46043296AE72057A68C8DFEF7AAEEFC5761F000165F519E22D1D9609944C7B0

Function 00C2B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00C2B25D
keybd_event.USER32(?,753DC0D0,?,00000000), ref: 00C2B270

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: dd8d924e7a1d0cb112aa145f70909d07089a9b8e55f755deb00c236f928e5ce2
Instruction ID: d2bd3b79c13401502ee60cf98a90b04b2b39d9d384f2d71c965ecb4c9ad5585b
Opcode Fuzzy Hash: dd8d924e7a1d0cb112aa145f70909d07089a9b8e55f755deb00c236f928e5ce2
Instruction Fuzzy Hash: 57F0177580438EAFDB059FA1D806BAE7FB4FF08309F00800AF965A61A2D3798651DF94

Function 00C210BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C211FC), ref: 00C210D4
CloseHandle.KERNEL32(?,?,00C211FC), ref: 00C210E9

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 43e0fe6b9757dcbbcba99b8093310b692d49e7c7bf2495468f7873631bca6e1d
Instruction ID: 4c191a5bff73270d8c127fc2de900e29f7b5281180e8f5f8c267b4dcb7224d07
Opcode Fuzzy Hash: 43e0fe6b9757dcbbcba99b8093310b692d49e7c7bf2495468f7873631bca6e1d
Instruction Fuzzy Hash: E3E04F36008711AFE7252B51FC05F77B7E9EB04321B14882EF4A6804B1DB626CD0DB50

Function 00BCCAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 00C10C40

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: fbaf0cc1532e393af13f115e1d2d8fb15fcdc435695a39ec637aeeb4a211752b
Instruction ID: ecf4314aee8160f5989b67c2b75d954635bc8684a0def95c0c978029cd85dcdb
Opcode Fuzzy Hash: fbaf0cc1532e393af13f115e1d2d8fb15fcdc435695a39ec637aeeb4a211752b
Instruction Fuzzy Hash: 853238709002189BCF14DF90C895FEDBBF5AF15304F2440ADE81AAB292D775AE86DB51

Function 00BF676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00BF6766,?,?,00000008,?,?,00BFFEFE,00000000), ref: 00BF6998

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 09f975698e689d843cf13b0ad6e2b68d4f38546a8aa3fd3fe15aaafcf4020533
Instruction ID: 8d6847fdee3f92dc7e21ae7730cf3dbd3ec37bdb9f345b10798d61870e3af896
Opcode Fuzzy Hash: 09f975698e689d843cf13b0ad6e2b68d4f38546a8aa3fd3fe15aaafcf4020533
Instruction Fuzzy Hash: 81B138316106089FD719CF28C48AB657BE0FF45364F258699ED99CF2A2C335E999CB40

Function 00BDB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 00C1851F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f53093c3cdcf74196120199bc93d0639b543a06df537ff21fd845c25f008cd86
Instruction ID: 9ecfc68a4b7c1d51aae0eb55146e49378402d7562613b2234677d2428272f584
Opcode Fuzzy Hash: f53093c3cdcf74196120199bc93d0639b543a06df537ff21fd845c25f008cd86
Instruction Fuzzy Hash: A9126D75900229DBDB24CF58C880AEEB7F5FF48710F15819AE849EB351EB309A85DF90

Function 00C3EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00C3EABD

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: d17a620fc9d4e03933696cb7d66b04ae852e40b33f9012aefaf3f3198b686530
Instruction ID: 504ae4a2be648453ee12d48f3e1e16daa82a15459ad16cde74801fe27bc382ba
Opcode Fuzzy Hash: d17a620fc9d4e03933696cb7d66b04ae852e40b33f9012aefaf3f3198b686530
Instruction Fuzzy Hash: 76E04F352102059FC710EF5AD845F9AFBE9AFA8760F00845AFC49D7391DB70E9418B90

Function 00BE09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00BE03EE), ref: 00BE09DA

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 56f52a11d304a2c87437279eb64601f5e38a60aa0a1cce66d1c8aebff4f2d3e5
Instruction ID: cfcc5121d0ddc2fa65b0914dfe349bcc715c45601571d5118f38911619fc3966
Opcode Fuzzy Hash: 56f52a11d304a2c87437279eb64601f5e38a60aa0a1cce66d1c8aebff4f2d3e5
Instruction Fuzzy Hash:

Function 00BE781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00BE798B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 5b26af6c2b5ee0fe9b6b58eb971fc93232f24140c19fb4777a24d292b0074053
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 9D5157716CCAC56ADB38856B889DBBE23C9DF22340F1806D9D886C7283CF15DE01D366

Function 00BF6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0801a8fb3c5a2d784cc01a803e03249773eb650d7d6dac757c9b17af747ccce9
Instruction ID: 80c473f3c29805c22c871c8c9416b4e4e069b5760b1d7690d9d7755fc364dd5d
Opcode Fuzzy Hash: 0801a8fb3c5a2d784cc01a803e03249773eb650d7d6dac757c9b17af747ccce9
Instruction Fuzzy Hash: E6323322D69F054DD7239635CC22339A289EFB73C5F14D777E81AB6AA9EF69C4834100

Function 00BDCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f5e534cfdbc44104fbb9a8bf7ec46e35ce15819acf22809a57f3619623012a
Instruction ID: b249eb6940d23c97610c2393fdf88fb67f72124554fceb700a6219197ea58ef0
Opcode Fuzzy Hash: 94f5e534cfdbc44104fbb9a8bf7ec46e35ce15819acf22809a57f3619623012a
Instruction Fuzzy Hash: 4A32D431A441568BDF24CA29C5D46FDBBA1EF46300F2885A7F56997392E230DEC1FB81

Function 00BC7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d547e3827e65f0aa091adbcf1ada9e9d97a02061056328afbc1020b812c7d4
Instruction ID: 6d619a084e876d23983e04229e6483ae8f85e999a94c9b7e6d8d1b63d9410171
Opcode Fuzzy Hash: e0d547e3827e65f0aa091adbcf1ada9e9d97a02061056328afbc1020b812c7d4
Instruction Fuzzy Hash: B8229F70A0460A9FDF14CFA5C881BAEB7F5FF48300F244569E816A7291EB36AE55CF50

Function 00BC91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11f25f8fdad627771276a4f1b96aadd2c3ab944a5aeb37880bd66d58064075e
Instruction ID: 7929c0a7be0b2b479116c98e102407f787ebb43df41992b2e5bad80980136083
Opcode Fuzzy Hash: c11f25f8fdad627771276a4f1b96aadd2c3ab944a5aeb37880bd66d58064075e
Instruction Fuzzy Hash: 3E02A6B1E0020AEBDB04DF54D881BAEB7F1FF44300F5085A9E8169B2D1EB31AE51DB95

Function 00BF9EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f209dfda1b22eb2137a02610fa38f5a0de3dc318116b0a342eb1b47e90b45ca
Instruction ID: 488e19cc3875905968f72e52b6524f7e3b99d14086aaec192928805e4de117ab
Opcode Fuzzy Hash: 1f209dfda1b22eb2137a02610fa38f5a0de3dc318116b0a342eb1b47e90b45ca
Instruction Fuzzy Hash: D2B1E420D2AF814DD323963A887133AB69CAFBB6D5F51D72BFC1674E62EB6185834140

Function 00BE1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: eb5dacfdf453d4ab3ee573c147f90bd38b558e5689caf8d7f26544ee4968bbca
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 549143726090E34ADB29463F857447DFEE1DA523A132A4BEDE4F2CA1C5EF348954D620

Function 00BE19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: f18e8a6392185895991b6a5bf2707544f1bc722495bb8447a60031870649695b
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: C19110762090E24ADB29467F857403DFEE19A923A232A1BEED4F2CA1C1FF3485559620

Function 00BE7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703057d24c5d9c5dd8f14526664fdbdf10c8c86e1bf7c019ee45547cb3518c0a
Instruction ID: 3cfeaf9c2409cbc6ed5bf970fc3b5e62b9df04ec17d03422ccddd9d8ccc4be49
Opcode Fuzzy Hash: 703057d24c5d9c5dd8f14526664fdbdf10c8c86e1bf7c019ee45547cb3518c0a
Instruction Fuzzy Hash: 876146716C87C996DA349A3B89B5BBE33D8DF41700F2019EAE847DB281DF119E428356

Function 00BE7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f9bbd8073c127d6260e5beb87550faccd87873262e1cd7263e8f4ca8b3d870
Instruction ID: 1e900545360840bd665acd260d94659939e6caccadd8d6d4c3311f2996dad81b
Opcode Fuzzy Hash: 90f9bbd8073c127d6260e5beb87550faccd87873262e1cd7263e8f4ca8b3d870
Instruction Fuzzy Hash: 176179B12C87C967DA388A2B4C95BBE23C9DF42700F1089F9E943DB281DF129D429355

Function 00BE1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: fa83bdc6fbc8b13b3727eeb7071c66f3269cf79b4ee33f3e120e0a9b89150e06
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 408154766090E349DB6D463F857447EFFE19A923A132A0BDDD4F2CA1C1EF348954E620

Function 00C32046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e10608460bad4ee5e25ed4c7303a51796a91fefa67a964d4991f0be1fa31d8e
Instruction ID: 63e05e3fca518d8ca434d6ef2c394724676c1cf0418d0360c6789ec176817d32
Opcode Fuzzy Hash: 8e10608460bad4ee5e25ed4c7303a51796a91fefa67a964d4991f0be1fa31d8e
Instruction Fuzzy Hash: 7A21A5326216118BDB2CCE79C8267BE73E5A754310F15862EE4A7C77D0DE35A904CB80

Function 00C42ADE Relevance: 79.2, APIs: 40, Strings: 5, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C42B30
DeleteObject.GDI32(00000000), ref: 00C42B43
DestroyWindow.USER32 ref: 00C42B52
GetDesktopWindow.USER32 ref: 00C42B6D
GetWindowRect.USER32(00000000), ref: 00C42B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00C42CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00C42CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C42CF8
GetClientRect.USER32(00000000,?), ref: 00C42D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00C42D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C42D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C42D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C42D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C42D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C42D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C42DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C42DA8
GlobalFree.KERNEL32(00000000), ref: 00C42DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C42DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00C5FC38,00000000), ref: 00C42DDB
GlobalFree.KERNEL32(00000000), ref: 00C42DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00C42E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00C42E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C42E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C4303F

Strings

DISPLAY, xrefs: 00C42EA2
static, xrefs: 00C42D3A, 00C42E91
AutoIt v3, xrefs: 00C42CF2
, xrefs: 00C42FC5
@U=u, xrefs: 00C42E30, 00C42FBF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $@U=u$AutoIt v3$DISPLAY$static
API String ID: 2211948467-3613752883
Opcode ID: ea61f7f6224ad0bb5912fa09b983c8f6752baae2b1b2f9fe80248a0b84339b2d
Instruction ID: 4f92fbdc2d8c13f51758eabcedfd579ef702acf6f62db5f1055535b0a71e0f2f
Opcode Fuzzy Hash: ea61f7f6224ad0bb5912fa09b983c8f6752baae2b1b2f9fe80248a0b84339b2d
Instruction Fuzzy Hash: EF025975900215AFDB14DFA4CC8AFAE7BB9FB48711F048158F915AB2A1CB74EE41CB60

Function 00C570D5 Relevance: 59.8, APIs: 33, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00C5712F
GetSysColorBrush.USER32(0000000F), ref: 00C57160
GetSysColor.USER32(0000000F), ref: 00C5716C
SetBkColor.GDI32(?,000000FF), ref: 00C57186
SelectObject.GDI32(?,?), ref: 00C57195
InflateRect.USER32(?,000000FF,000000FF), ref: 00C571C0
GetSysColor.USER32(00000010), ref: 00C571C8
CreateSolidBrush.GDI32(00000000), ref: 00C571CF
FrameRect.USER32(?,?,00000000), ref: 00C571DE
DeleteObject.GDI32(00000000), ref: 00C571E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00C57230
FillRect.USER32(?,?,?), ref: 00C57262
GetWindowLongW.USER32(?,000000F0), ref: 00C57284

Part of subcall function 00C573E8: GetSysColor.USER32(00000012), ref: 00C57421
Part of subcall function 00C573E8: SetTextColor.GDI32(?,?), ref: 00C57425
Part of subcall function 00C573E8: GetSysColorBrush.USER32(0000000F), ref: 00C5743B
Part of subcall function 00C573E8: GetSysColor.USER32(0000000F), ref: 00C57446
Part of subcall function 00C573E8: GetSysColor.USER32(00000011), ref: 00C57463
Part of subcall function 00C573E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C57471
Part of subcall function 00C573E8: SelectObject.GDI32(?,00000000), ref: 00C57482
Part of subcall function 00C573E8: SetBkColor.GDI32(?,00000000), ref: 00C5748B
Part of subcall function 00C573E8: SelectObject.GDI32(?,?), ref: 00C57498
Part of subcall function 00C573E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00C574B7
Part of subcall function 00C573E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C574CE
Part of subcall function 00C573E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00C574DB

Strings

@U=u, xrefs: 00C572CC

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID: @U=u
API String ID: 4124339563-2594219639
Opcode ID: a228476cb2288c60ea4ba1dbf2719056909cea15c9a342777cd23814be5117ab
Instruction ID: deb1137fb9c4ab1eb9c214c9a9a1540affd44d34cacbb10ec139ec8b4025b646
Opcode Fuzzy Hash: a228476cb2288c60ea4ba1dbf2719056909cea15c9a342777cd23814be5117ab
Instruction Fuzzy Hash: 67A17F7A008701AFDB019F60DC88B6F7BA9FB49322F100B19F962A61E1D771E9C4DB51

Function 00BD8D85 Relevance: 49.5, APIs: 26, Strings: 2, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00BD8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00C16AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00C16AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00C16F43

Part of subcall function 00BD8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BD8BE8,?,00000000,?,?,?,?,00BD8BBA,00000000,?), ref: 00BD8FC5

SendMessageW.USER32(?,00001053), ref: 00C16F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00C16F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00C16FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00C16FB7

Strings

0, xrefs: 00C16DCF
@U=u, xrefs: 00C16AC5, 00C16BD6, 00C16EBF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0$@U=u
API String ID: 2760611726-975001249
Opcode ID: de701364b3f5427d12a9518a1bca9c93d336d2a780b5cc747d42678380349b19
Instruction ID: 74b7af48d6a1a91b9670bc7ea659153802696a7a71618ee94f81698c4aea3ac1
Opcode Fuzzy Hash: de701364b3f5427d12a9518a1bca9c93d336d2a780b5cc747d42678380349b19
Instruction Fuzzy Hash: 2E12CE34204201DFCB22CF24C899BA9B7E5FF46301F1845AAF4959B261DB31ED92EF91

Function 00C42711 Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00C4273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00C4286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00C428A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00C428B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00C42900
GetClientRect.USER32(00000000,?), ref: 00C4290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00C42955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00C42964
GetStockObject.GDI32(00000011), ref: 00C42974
SelectObject.GDI32(00000000,00000000), ref: 00C42978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00C42988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C42991
DeleteDC.GDI32(00000000), ref: 00C4299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00C429C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00C429DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00C42A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00C42A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00C42A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00C42A77
GetStockObject.GDI32(00000011), ref: 00C42A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00C42A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00C42A97

Strings

DISPLAY, xrefs: 00C4295A
static, xrefs: 00C4294F, 00C42A71
AutoIt v3, xrefs: 00C428F8
msctls_progress32, xrefs: 00C42A13
@U=u, xrefs: 00C429CC

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: @U=u$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2771358697
Opcode ID: a2450a836613f9cbb93384fc64693862f9925aa085b3557708dde47835ce05d6
Instruction ID: ed799caf5033eceb9e6643bb98151c9af7c0efe4ba39a320e89add7fe36f2614
Opcode Fuzzy Hash: a2450a836613f9cbb93384fc64693862f9925aa085b3557708dde47835ce05d6
Instruction Fuzzy Hash: BDB14C75A40215AFEB14DF68CC8AFAE7BB9FB08711F004159F915E72A0DB74AD40CBA4

Function 00C573E8 Relevance: 47.5, APIs: 26, Strings: 1, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00C57421
SetTextColor.GDI32(?,?), ref: 00C57425
GetSysColorBrush.USER32(0000000F), ref: 00C5743B
GetSysColor.USER32(0000000F), ref: 00C57446
CreateSolidBrush.GDI32(?), ref: 00C5744B
GetSysColor.USER32(00000011), ref: 00C57463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C57471
SelectObject.GDI32(?,00000000), ref: 00C57482
SetBkColor.GDI32(?,00000000), ref: 00C5748B
SelectObject.GDI32(?,?), ref: 00C57498
InflateRect.USER32(?,000000FF,000000FF), ref: 00C574B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C574CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00C574DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C5752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00C57554
InflateRect.USER32(?,000000FD,000000FD), ref: 00C57572
DrawFocusRect.USER32(?,?), ref: 00C5757D
GetSysColor.USER32(00000011), ref: 00C5758E
SetTextColor.GDI32(?,00000000), ref: 00C57596
DrawTextW.USER32(?,00C570F5,000000FF,?,00000000), ref: 00C575A8
SelectObject.GDI32(?,?), ref: 00C575BF
DeleteObject.GDI32(?), ref: 00C575CA
SelectObject.GDI32(?,?), ref: 00C575D0
DeleteObject.GDI32(?), ref: 00C575D5
SetTextColor.GDI32(?,?), ref: 00C575DB
SetBkColor.GDI32(?,?), ref: 00C575E5

Strings

@U=u, xrefs: 00C5752A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID: @U=u
API String ID: 1996641542-2594219639
Opcode ID: 2990f19632a437dce0b3aec753958e9fe24fbc93bbe54d03dacd6e32b1102192
Instruction ID: 345da1e8eb722798b2f08c796d5185f4a3024091fa92d86e7c4c2082d004da35
Opcode Fuzzy Hash: 2990f19632a437dce0b3aec753958e9fe24fbc93bbe54d03dacd6e32b1102192
Instruction Fuzzy Hash: 6F614F7A904318AFDB019FA4DC89BAE7FB9EB08321F114215F915BB2A1D7749980DF90

Function 00C34ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C34AED
GetDriveTypeW.KERNEL32(?,00C5CB68,?,\\.\,00C5CC08), ref: 00C34BCA
SetErrorMode.KERNEL32(00000000,00C5CB68,?,\\.\,00C5CC08), ref: 00C34D36

Strings

SAS, xrefs: 00C34CC9
1394, xrefs: 00C34C9F
Network, xrefs: 00C34C02
ATA, xrefs: 00C34C98
MMC, xrefs: 00C34CDE
PhysicalDrive, xrefs: 00C34B76
Unknown, xrefs: 00C34BED, 00C34C83
SATA, xrefs: 00C34CD0
Removable, xrefs: 00C34C10, 00C34C15
SSD, xrefs: 00C34C4A
CDROM, xrefs: 00C34BFB
RAMDisk, xrefs: 00C34BF4
SCSI, xrefs: 00C34C8A
Virtual, xrefs: 00C34CE5
SSA, xrefs: 00C34CA6
Fixed, xrefs: 00C34C09
RAID, xrefs: 00C34CBB
FileBackedVirtual, xrefs: 00C34CEC
iSCSI, xrefs: 00C34CC2
ATAPI, xrefs: 00C34C91
\\.\, xrefs: 00C34B3F
Fibre, xrefs: 00C34CAD
USB, xrefs: 00C34CB4

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 12e54171a8118de29a64ef9e11802519389af45a948a9e8b81d36c649ab5edf0
Instruction ID: 01aad6c0fa3a4d00854dc5f0dc000be6ebb7569622e5e11cb8bc27524472e47e
Opcode Fuzzy Hash: 12e54171a8118de29a64ef9e11802519389af45a948a9e8b81d36c649ab5edf0
Instruction Fuzzy Hash: BB61D530715205DFCB0CEF25DA81E6DB7A0EB04748F24946AF806AB652DB35FE41DB85

Function 00C50241 Relevance: 37.1, APIs: 7, Strings: 14, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C502E5
_wcslen.LIBCMT ref: 00C5031F
_wcslen.LIBCMT ref: 00C50389
_wcslen.LIBCMT ref: 00C503F1
_wcslen.LIBCMT ref: 00C50475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00C504C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C50504

Part of subcall function 00BDF9F2: _wcslen.LIBCMT ref: 00BDF9FD

Part of subcall function 00C2223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C22258
Part of subcall function 00C2223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C2228A

Strings

SELECTINVERT, xrefs: 00C5057E
GETTEXT, xrefs: 00C503EC, 00C50407
FINDITEM, xrefs: 00C50627
GETITEMCOUNT, xrefs: 00C50316, 00C50337
GETSUBITEMCOUNT, xrefs: 00C50384, 00C5039F
DESELECT, xrefs: 00C5059C
@U=u, xrefs: 00C504C5, 00C50504
SELECTCLEAR, xrefs: 00C5052D
GETSELECTEDCOUNT, xrefs: 00C50470, 00C5048B
SELECT, xrefs: 00C50548
VIEWCHANGE, xrefs: 00C50675
SELECTALL, xrefs: 00C50515
ISSELECTED, xrefs: 00C504DD
GETSELECTED, xrefs: 00C505E1

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: @U=u$DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-1753161424
Opcode ID: 9208bdc84a27355a6f9a860e46f48c74947f12484143d4044e904d8b63edc858
Instruction ID: 12f961f2e3e6b62192a87533490a601b94693e3f71cccc0b68f3c0660666700d
Opcode Fuzzy Hash: 9208bdc84a27355a6f9a860e46f48c74947f12484143d4044e904d8b63edc858
Instruction Fuzzy Hash: A9E19F352182019FCB14DF24C45192EB3E5BF98315F2449ADFCA69B3A1EB30EE89CB45

Function 00C50FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00C51128
GetDesktopWindow.USER32 ref: 00C5113D
GetWindowRect.USER32(00000000), ref: 00C51144
GetWindowLongW.USER32(?,000000F0), ref: 00C51199
DestroyWindow.USER32(?), ref: 00C511B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00C511ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C5120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00C5121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00C51232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00C51245
IsWindowVisible.USER32(00000000), ref: 00C512A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00C512BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00C512D0
GetWindowRect.USER32(00000000,?), ref: 00C512E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00C5130E
GetMonitorInfoW.USER32(00000000,?), ref: 00C51328
CopyRect.USER32(?,?), ref: 00C5133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00C513AA

Strings

0, xrefs: 00C510D3
tooltips_class32, xrefs: 00C511E6
(, xrefs: 00C5131B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: fc0b695d0b752128f398608ff4a305b389bde67b864dcc6bc5812979dcde2267
Instruction ID: b2bb425deed3c27f1ddf2b6571bc37826175701ba2343f252773a6c8e217167e
Opcode Fuzzy Hash: fc0b695d0b752128f398608ff4a305b389bde67b864dcc6bc5812979dcde2267
Instruction Fuzzy Hash: E2B18A75604340AFD700DF64C889F6EBBE4EF84351F04895CF999AB2A1CB31E989CB95

Function 00BD8891 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BD8968
GetSystemMetrics.USER32(00000007), ref: 00BD8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00BD899B
GetSystemMetrics.USER32(00000008), ref: 00BD89A3
GetSystemMetrics.USER32(00000004), ref: 00BD89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00BD89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00BD89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00BD8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00BD8A3C
GetClientRect.USER32(00000000,000000FF), ref: 00BD8A5A
GetStockObject.GDI32(00000011), ref: 00BD8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BD8A81

Part of subcall function 00BD912D: GetCursorPos.USER32(?), ref: 00BD9141
Part of subcall function 00BD912D: ScreenToClient.USER32(00000000,?), ref: 00BD915E
Part of subcall function 00BD912D: GetAsyncKeyState.USER32(00000001), ref: 00BD9183
Part of subcall function 00BD912D: GetAsyncKeyState.USER32(00000002), ref: 00BD919D

SetTimer.USER32(00000000,00000000,00000028,00BD90FC), ref: 00BD8AA8

Strings

AutoIt v3 GUI, xrefs: 00BD8A20
@U=u, xrefs: 00BD8A81

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: @U=u$AutoIt v3 GUI
API String ID: 1458621304-2077007950
Opcode ID: 3be1dbc3b70619d6ec18b529bdef8d026b2f6bff8416ad9487cfa0d556642ded
Instruction ID: 7446aea58ae1626a0d177768f7ac8439394fc84531902f8fd6b3db8cf7bdd04c
Opcode Fuzzy Hash: 3be1dbc3b70619d6ec18b529bdef8d026b2f6bff8416ad9487cfa0d556642ded
Instruction Fuzzy Hash: 80B19E75A0030A9FDF04DFA8CC89BAE7BB1FB08315F05415AFA15A72D0DB34A980DB50

Function 00C25A1B Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00C25A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00C25A40
SetWindowTextW.USER32(?,?), ref: 00C25A57
GetDlgItem.USER32(?,000003EA), ref: 00C25A6C
SetWindowTextW.USER32(00000000,?), ref: 00C25A72
GetDlgItem.USER32(?,000003E9), ref: 00C25A82
SetWindowTextW.USER32(00000000,?), ref: 00C25A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00C25AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00C25AC3
GetWindowRect.USER32(?,?), ref: 00C25ACC
_wcslen.LIBCMT ref: 00C25B33
SetWindowTextW.USER32(?,?), ref: 00C25B6F
GetDesktopWindow.USER32 ref: 00C25B75
GetWindowRect.USER32(00000000), ref: 00C25B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00C25BD3
GetClientRect.USER32(?,?), ref: 00C25BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00C25C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00C25C2F

Strings

@U=u, xrefs: 00C25A40

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID: @U=u
API String ID: 895679908-2594219639
Opcode ID: 02c144d3a919a334b490f0a3699ded85a4e8df83ac920f80b7a4bc76cf4be587
Instruction ID: 2528a400fbee6d23b2ab89c079e90564d9004c2cdef46a73e0bc180697bcf688
Opcode Fuzzy Hash: 02c144d3a919a334b490f0a3699ded85a4e8df83ac920f80b7a4bc76cf4be587
Instruction Fuzzy Hash: 9E718A31900B19EFCB20DFA8DE85BAFBBF5FF48705F104518E552A29A0DB71AA40CB50

Function 00C5091E Relevance: 31.9, APIs: 6, Strings: 12, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C509C6
_wcslen.LIBCMT ref: 00C50A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C50A54
_wcslen.LIBCMT ref: 00C50A8A
_wcslen.LIBCMT ref: 00C50B06
_wcslen.LIBCMT ref: 00C50B81

Part of subcall function 00BDF9F2: _wcslen.LIBCMT ref: 00BDF9FD

Part of subcall function 00C22BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C22BFA

Strings

EXISTS, xrefs: 00C50B7C, 00C50B97
UNCHECK, xrefs: 00C50D3E
GETTEXT, xrefs: 00C50C97
SELECT, xrefs: 00C50D11
CHECK, xrefs: 00C50A85, 00C50AA0
GETTOTALCOUNT, xrefs: 00C509F2, 00C50A17
EXPAND, xrefs: 00C50BF8
GETITEMCOUNT, xrefs: 00C50C1E
@U=u, xrefs: 00C50A54
GETSELECTED, xrefs: 00C50C4E
COLLAPSE, xrefs: 00C50B01, 00C50B1C
ISCHECKED, xrefs: 00C50CE1

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: @U=u$CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-383632319
Opcode ID: cd8d43e1abecc9837aeb1cc25911017a22a9f49aa1093cd174a5839ccbfcceab
Instruction ID: 7559c7f4d79af6c8fe436acfbe931ead78c1722155f7d3244d8f083e4d05c82d
Opcode Fuzzy Hash: cd8d43e1abecc9837aeb1cc25911017a22a9f49aa1093cd174a5839ccbfcceab
Instruction Fuzzy Hash: BFE1A1392083019FC714DF25C49092AB7E1FF94315F24499DF8A69B362D731EE89CB85

Function 00C20D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C210F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C21114
Part of subcall function 00C210F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00C20B9B,?,?,?), ref: 00C21120
Part of subcall function 00C210F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00C20B9B,?,?,?), ref: 00C2112F
Part of subcall function 00C210F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00C20B9B,?,?,?), ref: 00C21136
Part of subcall function 00C210F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C2114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00C20DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00C20E29
GetLengthSid.ADVAPI32(?), ref: 00C20E40
GetAce.ADVAPI32(?,00000000,?), ref: 00C20E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00C20E96
GetLengthSid.ADVAPI32(?), ref: 00C20EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00C20EB5
HeapAlloc.KERNEL32(00000000), ref: 00C20EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00C20EDD
CopySid.ADVAPI32(00000000), ref: 00C20EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00C20F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C20F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00C20F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C20F6E
HeapFree.KERNEL32(00000000), ref: 00C20F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C20F7E
HeapFree.KERNEL32(00000000), ref: 00C20F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C20F8E
HeapFree.KERNEL32(00000000), ref: 00C20F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00C20FA1
HeapFree.KERNEL32(00000000), ref: 00C20FA8

Part of subcall function 00C21193: GetProcessHeap.KERNEL32(00000008,00C20BB1,?,00000000,?,00C20BB1,?), ref: 00C211A1
Part of subcall function 00C21193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00C20BB1,?), ref: 00C211A8
Part of subcall function 00C21193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00C20BB1,?), ref: 00C211B7

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 4fce8c821bd3fe6ccbe5858e4dd1fcb8a8f3d23ef2b917a173de069fcb145c83
Instruction ID: 8671b0fb8b5eb7377272ab2d3fef7262be2fe86bce48068cd819edb5d56fb165
Opcode Fuzzy Hash: 4fce8c821bd3fe6ccbe5858e4dd1fcb8a8f3d23ef2b917a173de069fcb145c83
Instruction Fuzzy Hash: CF717C7690031AAFDF20DFA4ED85BAEBBB8FF04311F144116F929B6192D7309A55CB60

Function 00C5833C Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C5835A
_wcslen.LIBCMT ref: 00C5836E
_wcslen.LIBCMT ref: 00C58391
_wcslen.LIBCMT ref: 00C583B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00C583F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00C5361A,?), ref: 00C5844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C58487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00C584CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C58501
FreeLibrary.KERNEL32(?), ref: 00C5850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00C5851D
DestroyIcon.USER32(?), ref: 00C5852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00C58549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00C58555

Strings

.exe, xrefs: 00C58388
.dll, xrefs: 00C583AB
.icl, xrefs: 00C58368
@U=u, xrefs: 00C58535

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl$@U=u
API String ID: 799131459-1639919054
Opcode ID: 5f36e7b484baf4d54a4b159119444c7df7414d4dc1b46d517f5b49adddc2e7b4
Instruction ID: 771e736fe961340f192afdf20aeb8434f642bd423c294c9efe3a1de27e065f41
Opcode Fuzzy Hash: 5f36e7b484baf4d54a4b159119444c7df7414d4dc1b46d517f5b49adddc2e7b4
Instruction Fuzzy Hash: 5B61DF75500315BEEB14DF64CC81BBE77A8FB04722F104659FC25E60D1EB74AA88DBA4

Function 00C4C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C4C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00C5CC08,00000000,?,00000000,?,?), ref: 00C4C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00C4C5A4
_wcslen.LIBCMT ref: 00C4C5F4
_wcslen.LIBCMT ref: 00C4C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00C4C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00C4C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00C4C84D
RegCloseKey.ADVAPI32(?), ref: 00C4C881
RegCloseKey.ADVAPI32(00000000), ref: 00C4C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00C4C960

Strings

REG_QWORD, xrefs: 00C4C8C3
REG_MULTI_SZ, xrefs: 00C4C6F5
REG_BINARY, xrefs: 00C4C913
REG_EXPAND_SZ, xrefs: 00C4C5CD
REG_SZ, xrefs: 00C4C644
REG_DWORD, xrefs: 00C4C804

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 73a51170fe2bbbff1d8286acfd3e16f7c0b1c41ae6b0bd2605c459f9a2f0767a
Instruction ID: 57cca7c3d1954a76a80283e0f0bd2c55f8458f9da0aecc7af061dd2c6076a78c
Opcode Fuzzy Hash: 73a51170fe2bbbff1d8286acfd3e16f7c0b1c41ae6b0bd2605c459f9a2f0767a
Instruction Fuzzy Hash: 521225356042019FDB54DF24C891F2AB7E5FF88724F14889DF89A9B2A2DB31ED41CB85

Function 00C4C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C4B6AE,?,?), ref: 00C4C9B5
_wcslen.LIBCMT ref: 00C4C9F1
_wcslen.LIBCMT ref: 00C4CA68
_wcslen.LIBCMT ref: 00C4CA9E
_wcslen.LIBCMT ref: 00C4CAF9
_wcslen.LIBCMT ref: 00C4CB2F
_wcslen.LIBCMT ref: 00C4CB7F

Strings

HKCC, xrefs: 00C4CBAC
HKEY_CURRENT_CONFIG, xrefs: 00C4CB79, 00C4CB7E
HKCR, xrefs: 00C4CB29, 00C4CB2E
HKEY_USERS, xrefs: 00C4CBDF
HKEY_LOCAL_MACHINE, xrefs: 00C4CA62, 00C4CA67
HKLM, xrefs: 00C4CA98, 00C4CA9D
HKEY_CURRENT_USER, xrefs: 00C4CBBD
HKEY_CLASSES_ROOT, xrefs: 00C4CAF3, 00C4CAF8
HKCU, xrefs: 00C4CBCE
HKU, xrefs: 00C4CBF0

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 447eae80271b4229c6fcccb9a7f502d21ad3f7a1df1ab99344a211a1a1ef5c0e
Instruction ID: ad5948973848837bd6a4ece43a6c01eae2a645cee814a3fc394ca94e516cae98
Opcode Fuzzy Hash: 447eae80271b4229c6fcccb9a7f502d21ad3f7a1df1ab99344a211a1a1ef5c0e
Instruction Fuzzy Hash: 0571073260112A8BCB50DE7DC9D16BE3391BF60754B250568FC76A72A4FB31CE44D3A0

Function 00BC7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

Unterminated group of comments, xrefs: 00C0528C
#OnAutoItStartRegister, xrefs: 00BC7817
", xrefs: 00C05153
#pragma compile, xrefs: 00BC77D3
#notrayicon, xrefs: 00BC77E7
Cannot parse #include, xrefs: 00C05279
#cs, xrefs: 00BC7873, 00BC78C5
#include, xrefs: 00BC7847
#include-once, xrefs: 00BC782F
Bad directive syntax error, xrefs: 00C0519A
', xrefs: 00C05169
#comments-start, xrefs: 00BC785F, 00BC78B1
#comments-end, xrefs: 00BC78D9
#requireadmin, xrefs: 00BC77FF
#ce, xrefs: 00BC78ED

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: e946ff4147c7eb713a85bb9b4fce561576b51bc842d251adf85c1a44d9c7a5d2
Instruction ID: b5976e6ae6c6e1a528b8c6433fc6481ddbe655d38c9c84e83aa6723fc4744dce
Opcode Fuzzy Hash: e946ff4147c7eb713a85bb9b4fce561576b51bc842d251adf85c1a44d9c7a5d2
Instruction Fuzzy Hash: 1581F571644605BBDB20AF61CC42FAF37E8EF14300F0440A9F909AA192EF70DE55CBA5

Function 00C5856F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00C58592
GetFileSize.KERNEL32(00000000,00000000), ref: 00C585A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00C585AD
CloseHandle.KERNEL32(00000000), ref: 00C585BA
GlobalLock.KERNEL32(00000000), ref: 00C585C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00C585D7
GlobalUnlock.KERNEL32(00000000), ref: 00C585E0
CloseHandle.KERNEL32(00000000), ref: 00C585E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00C585F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00C5FC38,?), ref: 00C58611
GlobalFree.KERNEL32(00000000), ref: 00C58621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00C58641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00C58671
DeleteObject.GDI32(00000000), ref: 00C58699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00C586AF

Strings

@U=u, xrefs: 00C586AF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID: @U=u
API String ID: 3840717409-2594219639
Opcode ID: d5b43a9aa80a4194cb330a2466f60a561f5f61564e99e4d29c5b8eb1cf2e521a
Instruction ID: 03dbab24d782913aa2128c205da5a6916a05b3e3405f5a8830906f921d6c85ed
Opcode Fuzzy Hash: d5b43a9aa80a4194cb330a2466f60a561f5f61564e99e4d29c5b8eb1cf2e521a
Instruction Fuzzy Hash: 2D410A79600308AFDB119FA5CC88FAE7BB8EF99712F104059F915E7260DB309A85CB64

Function 00BE00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00BE00C6

Part of subcall function 00BE00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00C9070C,00000FA0,03CA2DA2,?,?,?,?,00C023B3,000000FF), ref: 00BE011C
Part of subcall function 00BE00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00C023B3,000000FF), ref: 00BE0127
Part of subcall function 00BE00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00C023B3,000000FF), ref: 00BE0138
Part of subcall function 00BE00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00BE014E
Part of subcall function 00BE00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00BE015C
Part of subcall function 00BE00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00BE016A
Part of subcall function 00BE00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00BE0195
Part of subcall function 00BE00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00BE01A0

___scrt_fastfail.LIBCMT ref: 00BE00E7

Part of subcall function 00BE00A3: __onexit.LIBCMT ref: 00BE00A9

Strings

kernel32.dll, xrefs: 00BE0133
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00BE0122
InitializeConditionVariable, xrefs: 00BE0148
SleepConditionVariableCS, xrefs: 00BE0154
WakeAllConditionVariable, xrefs: 00BE0162

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 6b84a60a6a9fff035187687c02c8b7cfd1d73ae25f549028d1e22ba6da1b23f3
Instruction ID: 356ecf69975f34a3408bc987b16cb5b978fadc359a400c4749653c5c024ca077
Opcode Fuzzy Hash: 6b84a60a6a9fff035187687c02c8b7cfd1d73ae25f549028d1e22ba6da1b23f3
Instruction Fuzzy Hash: 5A212636654741AFE7107BB5AC49B2E73E4DF04B62F10017AF802B62A1DFB09C808A95

Function 00C230F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C2318D
_wcslen.LIBCMT ref: 00C231F8

Strings

REGEXPCLASS, xrefs: 00C23255, 00C23266
INSTANCE, xrefs: 00C23453
CLASSNN, xrefs: 00C231F3, 00C23204
TEXT, xrefs: 00C2347C
CLASS, xrefs: 00C23188, 00C231A5
NAME, xrefs: 00C23335, 00C23346

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 9f5312b3374403d93622fda522a0eadb74812b6fcc637c198c868b3d5d33b121
Instruction ID: edebf0e26804d56a978fa2ca42a5331964448dbe7a9b908dcc6b216e45201fe6
Opcode Fuzzy Hash: 9f5312b3374403d93622fda522a0eadb74812b6fcc637c198c868b3d5d33b121
Instruction Fuzzy Hash: DDE12732A00566ABCF14DFA4D841BFDFBB0BF54710F14816AE466B7640DB34AF858790

Function 00C344C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00C5CC08), ref: 00C34527
_wcslen.LIBCMT ref: 00C3453B
_wcslen.LIBCMT ref: 00C34599
_wcslen.LIBCMT ref: 00C345F4
_wcslen.LIBCMT ref: 00C3463F
_wcslen.LIBCMT ref: 00C346A7

Part of subcall function 00BDF9F2: _wcslen.LIBCMT ref: 00BDF9FD

GetDriveTypeW.KERNEL32(?,00C86BF0,00000061), ref: 00C34743

Strings

ramdisk, xrefs: 00C346F1
all, xrefs: 00C34531, 00C34536
removable, xrefs: 00C345EA, 00C345EF
network, xrefs: 00C3469D, 00C346A2
unknown, xrefs: 00C34708
cdrom, xrefs: 00C3458F, 00C34594
fixed, xrefs: 00C34635, 00C3463A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: fc9ab9938021d53035185b8c69f68349d5471776c1872b39761376816abdf4fd
Instruction ID: 383c93e93fb982b65f8e7633f8fa8ba2145617bcbff43a05aed9b2213172ca33
Opcode Fuzzy Hash: fc9ab9938021d53035185b8c69f68349d5471776c1872b39761376816abdf4fd
Instruction Fuzzy Hash: DBB132716183029FC718DF28C891A7EB7E5AFA6724F50491DF4A6C3291D730EA44CB92

Function 00C56CD9 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00C56DEB

Part of subcall function 00BC6B57: _wcslen.LIBCMT ref: 00BC6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00C56E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00C56E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C56E94
DestroyWindow.USER32(?), ref: 00C56EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00BC0000,00000000), ref: 00C56EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C56EFD
GetDesktopWindow.USER32 ref: 00C56F16
GetWindowRect.USER32(00000000), ref: 00C56F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00C56F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00C56F4D

Part of subcall function 00BD9944: GetWindowLongW.USER32(?,000000EB), ref: 00BD9952

Strings

0, xrefs: 00C56D98
tooltips_class32, xrefs: 00C56E58, 00C56EDD
@U=u, xrefs: 00C56E81, 00C56E94, 00C56EFD, 00C56F27

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$@U=u$tooltips_class32
API String ID: 2429346358-1130792468
Opcode ID: a09e90ead9fcfb2a4d2a69633361afe2d953556147a93d98a312788ae176e9f2
Instruction ID: 627148d9a9b544dc819b667af1995019fc92528a143d55360069fcb9bea4c520
Opcode Fuzzy Hash: a09e90ead9fcfb2a4d2a69633361afe2d953556147a93d98a312788ae176e9f2
Instruction Fuzzy Hash: 4171BC78500340AFDB21CF18DC89F6ABBE9FB89305F44061EF99897261C770EA89CB15

Function 00C5911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BD9BB2

DragQueryPoint.SHELL32(?,?), ref: 00C59147

Part of subcall function 00C57674: ClientToScreen.USER32(?,?), ref: 00C5769A
Part of subcall function 00C57674: GetWindowRect.USER32(?,?), ref: 00C57710
Part of subcall function 00C57674: PtInRect.USER32(?,?,00C58B89), ref: 00C57720

SendMessageW.USER32(?,000000B0,?,?), ref: 00C591B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00C591BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00C591DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00C59225
SendMessageW.USER32(?,000000B0,?,?), ref: 00C5923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00C59255
SendMessageW.USER32(?,000000B1,?,?), ref: 00C59277
DragFinish.SHELL32(?), ref: 00C5927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00C59371

Strings

@GUI_DROPID, xrefs: 00C5929E
@U=u, xrefs: 00C591B0, 00C59225, 00C5923E, 00C59255, 00C59277
@GUI_DRAGFILE, xrefs: 00C59320
@GUI_DRAGID, xrefs: 00C592E9

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$@U=u
API String ID: 221274066-762882726
Opcode ID: bbb28478bfb328c7fce5e38627cc208fcd2b90d6437ca3d2bbfba4d90fa0e398
Instruction ID: eff9668f0fb420dbc0dbea421e9622926c4665e92ddd0b11521a92f12510cec5
Opcode Fuzzy Hash: bbb28478bfb328c7fce5e38627cc208fcd2b90d6437ca3d2bbfba4d90fa0e398
Instruction Fuzzy Hash: 8A617E71108301AFD701DF64DC89EAFBBE8EF89750F00096EF995931A1DB709A89CB56

Function 00BC326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00C91990), ref: 00C02F8D
GetMenuItemCount.USER32(00C91990), ref: 00C0303D
GetCursorPos.USER32(?), ref: 00C03081
SetForegroundWindow.USER32(00000000), ref: 00C0308A
TrackPopupMenuEx.USER32(00C91990,00000000,?,00000000,00000000,00000000), ref: 00C0309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00C030A9

Strings

0, xrefs: 00BC327D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 202a9a663b1a8ae53a677fa201ebb5773d9e9eb749a886514896b332fb9bbd37
Instruction ID: de57844f737312347eca52e98d77a67b8a8fd03332107f044df25c2b8fcf3896
Opcode Fuzzy Hash: 202a9a663b1a8ae53a677fa201ebb5773d9e9eb749a886514896b332fb9bbd37
Instruction Fuzzy Hash: 2E71F870644316BEEB218F64DC89F9EBFA8FF04764F244216F5256A1E0C7B1AE50DB50

Function 00C3C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C3C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00C3C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00C3C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00C3C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00C3C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00C3C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C3C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00C3C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00C3C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00C3C5F0
InternetCloseHandle.WININET(00000000), ref: 00C3C5FB

Strings

, xrefs: 00C3C575

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 8ea9640bbeeba0b2434b6ed33be5434829082e2d7817ce1c5682030b0bf0b5be
Instruction ID: f2a0954108946b6ce6a4111ad3ae47f16a25b4d03e4a4ae426313340de5b3d58
Opcode Fuzzy Hash: 8ea9640bbeeba0b2434b6ed33be5434829082e2d7817ce1c5682030b0bf0b5be
Instruction Fuzzy Hash: A95138B5510308AFDB219F61CDC8BAE7BBCEB08795F004419F956A6610DB34EA44EBA0

Function 00C314BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00C31502
VariantCopy.OLEAUT32(?,?), ref: 00C3150B
VariantClear.OLEAUT32(?), ref: 00C31517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00C315FB
VarR8FromDec.OLEAUT32(?,?), ref: 00C31657
VariantInit.OLEAUT32(?), ref: 00C31708
SysFreeString.OLEAUT32(?), ref: 00C3178C
VariantClear.OLEAUT32(?), ref: 00C317D8
VariantClear.OLEAUT32(?), ref: 00C317E7
VariantInit.OLEAUT32(00000000), ref: 00C31823

Strings

Default, xrefs: 00C316AF
%4d%02d%02d%02d%02d%02d, xrefs: 00C31625

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: b5fcaad898ff2b144f9f5616c665d57a49ff684afff03e2699a68087def08f12
Instruction ID: eab0329a25fa135241f40cdbf8b817d644830961669c99aa812f4cfd85ac03c0
Opcode Fuzzy Hash: b5fcaad898ff2b144f9f5616c665d57a49ff684afff03e2699a68087def08f12
Instruction Fuzzy Hash: C1D1D131A10219EFDB10AF66D885B7DB7F5BF45700F1884AAF816AB280DB30ED45DB61

Function 00C4B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

Part of subcall function 00C4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C4B6AE,?,?), ref: 00C4C9B5
Part of subcall function 00C4C998: _wcslen.LIBCMT ref: 00C4C9F1
Part of subcall function 00C4C998: _wcslen.LIBCMT ref: 00C4CA68
Part of subcall function 00C4C998: _wcslen.LIBCMT ref: 00C4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C4B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C4B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00C4B80A
RegCloseKey.ADVAPI32(?), ref: 00C4B87E
RegCloseKey.ADVAPI32(?), ref: 00C4B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00C4B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00C4B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00C4B922
FreeLibrary.KERNEL32(00000000), ref: 00C4B983
RegCloseKey.ADVAPI32(00000000), ref: 00C4B994

Strings

RegDeleteKeyExW, xrefs: 00C4B8FE
advapi32.dll, xrefs: 00C4B8ED

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: be04d8e6053d58b5716d40a15f3ffbc787f18a3945518583537518710fef0ca1
Instruction ID: 5ebc546d46ff46755f350165c8e7e371f7b1e46dab9b646d5809c9788e48729f
Opcode Fuzzy Hash: be04d8e6053d58b5716d40a15f3ffbc787f18a3945518583537518710fef0ca1
Instruction Fuzzy Hash: C9C16A34208201AFD714DF24C495F2ABBE5FF94318F14859CF5AA9B2A2CB71ED46CB91

Function 00C5541D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00C55504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C55515
CharNextW.USER32(00000158), ref: 00C55544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00C55585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00C5559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C555AC

Strings

@U=u, xrefs: 00C55504, 00C55515, 00C5554A, 00C555C9, 00C5562B, 00C55816

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID: @U=u
API String ID: 1350042424-2594219639
Opcode ID: 38d9329084ea03911ad4ac12265352f1bf1664394015bf7de2b5c730e1b44a4b
Instruction ID: 20b68574f2342189263a2df29211dce3c79bb938271fc52dff83c1e3d3d9a3d4
Opcode Fuzzy Hash: 38d9329084ea03911ad4ac12265352f1bf1664394015bf7de2b5c730e1b44a4b
Instruction Fuzzy Hash: 6F619A78900609EFDF108F95CCA5AFE7BB9EB09322F104145FD25AA290D7748BC9DB64

Function 00C4255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C425D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00C425E8
CreateCompatibleDC.GDI32(?), ref: 00C425F4
SelectObject.GDI32(00000000,?), ref: 00C42601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00C4266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00C426AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00C426D0
SelectObject.GDI32(?,?), ref: 00C426D8
DeleteObject.GDI32(?), ref: 00C426E1
DeleteDC.GDI32(?), ref: 00C426E8
ReleaseDC.USER32(00000000,?), ref: 00C426F3

Strings

(, xrefs: 00C4268D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: c558a7f6f6bd62a425a001f02e172e7892f208c22d18849d5d0e50b5867d1c83
Instruction ID: ff585cffd7a21f4df876c279ba0e45b4382d74d6cbc3c4e739209f8c33158731
Opcode Fuzzy Hash: c558a7f6f6bd62a425a001f02e172e7892f208c22d18849d5d0e50b5867d1c83
Instruction Fuzzy Hash: DC61D175D00219EFCF04CFA8D885AAEBBB5FF48310F208529F956A7250E770A951DF50

Function 00C2E6B0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00C2E6B4

Part of subcall function 00BDE551: timeGetTime.WINMM(?,?,00C2E6D4), ref: 00BDE555

Sleep.KERNEL32(0000000A), ref: 00C2E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00C2E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00C2E727
SetActiveWindow.USER32 ref: 00C2E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00C2E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00C2E773
Sleep.KERNEL32(000000FA), ref: 00C2E77E
IsWindow.USER32 ref: 00C2E78A
EndDialog.USER32(00000000), ref: 00C2E79B

Strings

@U=u, xrefs: 00C2E754, 00C2E773
BUTTON, xrefs: 00C2E719

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: @U=u$BUTTON
API String ID: 1194449130-2582809321
Opcode ID: 2e4a340f70fe8ec50918d8a8c23504e4accb73ec4f49da6cfd91590e6a7658b6
Instruction ID: 038eb00e321db2e0d37ecaa47572b8dd7abfd27de531e046418b2602a46c9659
Opcode Fuzzy Hash: 2e4a340f70fe8ec50918d8a8c23504e4accb73ec4f49da6cfd91590e6a7658b6
Instruction Fuzzy Hash: 8121AEB4204715BFEB005F60FCCDB2E3B69F75474AB100426F812E2AB2DB71AE409B24

Function 00BFDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00BFDAA1

Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD659
Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD66B
Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD67D
Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD68F
Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD6A1
Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD6B3
Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD6C5
Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD6D7
Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD6E9
Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD6FB
Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD70D
Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD71F
Part of subcall function 00BFD63C: _free.LIBCMT ref: 00BFD731

_free.LIBCMT ref: 00BFDA96

Part of subcall function 00BF29C8: HeapFree.KERNEL32(00000000,00000000,?,00BFD7D1,00000000,00000000,00000000,00000000,?,00BFD7F8,00000000,00000007,00000000,?,00BFDBF5,00000000), ref: 00BF29DE
Part of subcall function 00BF29C8: GetLastError.KERNEL32(00000000,?,00BFD7D1,00000000,00000000,00000000,00000000,?,00BFD7F8,00000000,00000007,00000000,?,00BFDBF5,00000000,00000000), ref: 00BF29F0

_free.LIBCMT ref: 00BFDAB8
_free.LIBCMT ref: 00BFDACD
_free.LIBCMT ref: 00BFDAD8
_free.LIBCMT ref: 00BFDAFA
_free.LIBCMT ref: 00BFDB0D
_free.LIBCMT ref: 00BFDB1B
_free.LIBCMT ref: 00BFDB26
_free.LIBCMT ref: 00BFDB5E
_free.LIBCMT ref: 00BFDB65
_free.LIBCMT ref: 00BFDB82
_free.LIBCMT ref: 00BFDB9A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 43f5d4812884c75e689582d9fe9757b12f11552545ed2f115898cf9627e6c8e6
Instruction ID: e882c109694bd13784d41394140330bfa1382c524b0db33d55aa119a66d5464c
Opcode Fuzzy Hash: 43f5d4812884c75e689582d9fe9757b12f11552545ed2f115898cf9627e6c8e6
Instruction Fuzzy Hash: 6D315C3164420D9FEB21AF38E845B7AB7EAFF00311F1185A9E648D7292DA71EC488724

Function 00C2365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00C2369C
_wcslen.LIBCMT ref: 00C236A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00C23797
GetClassNameW.USER32(?,?,00000400), ref: 00C2380C
GetDlgCtrlID.USER32(?), ref: 00C2385D
GetWindowRect.USER32(?,?), ref: 00C23882
GetParent.USER32(?), ref: 00C238A0
ScreenToClient.USER32(00000000), ref: 00C238A7
GetClassNameW.USER32(?,?,00000100), ref: 00C23921
GetWindowTextW.USER32(?,?,00000400), ref: 00C2395D

Strings

%s%u, xrefs: 00C23734

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 80691510f1af5af929517f3262e2c8dcdd1926cc1608168e7465f0c5f27cb577
Instruction ID: 63a394a7d5d4021189d01dbd776e549a9ee0b6e5d3f4fc4fecf49e7f166a0b5e
Opcode Fuzzy Hash: 80691510f1af5af929517f3262e2c8dcdd1926cc1608168e7465f0c5f27cb577
Instruction Fuzzy Hash: FE91E071200366AFD719EF24D885BAAF7E8FF44340F008529F9A9D2590DB34EB85CB91

Function 00C24954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00C24994
GetWindowTextW.USER32(?,?,00000400), ref: 00C249DA
_wcslen.LIBCMT ref: 00C249EB
CharUpperBuffW.USER32(?,00000000), ref: 00C249F7
_wcsstr.LIBVCRUNTIME ref: 00C24A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00C24A64
GetWindowTextW.USER32(?,?,00000400), ref: 00C24A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00C24AE6
GetClassNameW.USER32(?,?,00000400), ref: 00C24B20
GetWindowRect.USER32(?,?), ref: 00C24B8B

Strings

ThumbnailClass, xrefs: 00C24A6F, 00C24AF1

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 0d62631fb1549ced6df7dffd033dd20b7d3b5ecb95abb307b3f6cf511515deb4
Instruction ID: 34832cf9427b68a99130cbddb322e5d6caacf580cdd6feefbea499df975720d7
Opcode Fuzzy Hash: 0d62631fb1549ced6df7dffd033dd20b7d3b5ecb95abb307b3f6cf511515deb4
Instruction Fuzzy Hash: 1991E0311043159FDB08DF14E985FAAB7E8FF84314F04846AFD959A496DB30EE85CBA1

Function 00C58D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BD9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00C58D5A
GetFocus.USER32 ref: 00C58D6A
GetDlgCtrlID.USER32(00000000), ref: 00C58D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00C58E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00C58ECF
GetMenuItemCount.USER32(?), ref: 00C58EEC
GetMenuItemID.USER32(?,00000000), ref: 00C58EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00C58F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00C58F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C58FA1

Strings

0, xrefs: 00C58E9F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 6c23586f67770624004772141d2ad484996bcc92d70bf6c877b8b06d1ba1bc91
Instruction ID: 6546f61fd07f512fcc6b5f39477ad8ca4048079d4fc1f43686bb784d6085c6c8
Opcode Fuzzy Hash: 6c23586f67770624004772141d2ad484996bcc92d70bf6c877b8b06d1ba1bc91
Instruction Fuzzy Hash: 1581EF795083019FDB10CF14C885A6BBBF9FB88315F040A19FD95A7291DB70DE88CB69

Function 00C2DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00C2DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00C2DC46
_wcslen.LIBCMT ref: 00C2DC50
_wcsstr.LIBVCRUNTIME ref: 00C2DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00C2DCBC

Strings

04090000, xrefs: 00C2DCF2
\VarFileInfo\Translation, xrefs: 00C2DCB4
%u.%u.%u.%u, xrefs: 00C2DD9A
DefaultLangCodepage, xrefs: 00C2DD1F
StringFileInfo\, xrefs: 00C2DC8F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 83c16a118b959b70ef5ba4a07c3c3adc26a7159b920efd500ec633989c8e4d34
Instruction ID: c42ad837138a86d5cd52e274685c5655278020589ec55f81c8d2312ba125ce46
Opcode Fuzzy Hash: 83c16a118b959b70ef5ba4a07c3c3adc26a7159b920efd500ec633989c8e4d34
Instruction Fuzzy Hash: 094123369403117BDB10AB65EC87EFF77ECEF55751F1000AAF902A6182EB719A0187B9

Function 00C4CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00C4CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00C4CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00C4CD48

Part of subcall function 00C4CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00C4CCAA
Part of subcall function 00C4CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00C4CCBD
Part of subcall function 00C4CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00C4CCCF
Part of subcall function 00C4CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00C4CD05
Part of subcall function 00C4CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00C4CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00C4CCF3

Strings

RegDeleteKeyExW, xrefs: 00C4CCC9
advapi32.dll, xrefs: 00C4CCB8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 469e3c975e77cafad5d87f1ff80fc6280565cd6928a364d1d4e545e683f942cd
Instruction ID: 3384e457cd4ed7b1676471b366ef0676ca65c690b3b54d80dbddacc549021f83
Opcode Fuzzy Hash: 469e3c975e77cafad5d87f1ff80fc6280565cd6928a364d1d4e545e683f942cd
Instruction Fuzzy Hash: 99317A75902229BFDB209B91DCC8FFFBB7CEF45751F000165E916E2260DA349A85DAA0

Function 00C33D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00C33D40
_wcslen.LIBCMT ref: 00C33D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C33D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00C33DBE
RemoveDirectoryW.KERNEL32(?), ref: 00C33DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00C33E55
CloseHandle.KERNEL32(00000000), ref: 00C33E60
CloseHandle.KERNEL32(00000000), ref: 00C33E6B

Strings

\??\%s, xrefs: 00C33D5B
\, xrefs: 00C33D77
:, xrefs: 00C33D82

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: fe0c342e9353eefe656a8be7366cba27a287255d1e674b17eec203658c1cad6a
Instruction ID: 43c3384279025cb9d28a21ca0b8c4680edf620a6eee7f069aef46f6dad6468a7
Opcode Fuzzy Hash: fe0c342e9353eefe656a8be7366cba27a287255d1e674b17eec203658c1cad6a
Instruction Fuzzy Hash: CF31B275910249ABDB219FA0DC89FEF77BCEF88701F1040B6F619E6160EB7497848B24

Function 00C2E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00C2EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00C2EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C2EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00C2EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00C2EAA7

Strings

alias PlayMe, xrefs: 00C2EA36
play PlayMe, xrefs: 00C2EAA2
close PlayMe, xrefs: 00C2EA6E, 00C2EA9B
open , xrefs: 00C2EA0C
status PlayMe mode, xrefs: 00C2EA58
play PlayMe wait, xrefs: 00C2EA91

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 426a745d261e4c4a712e4b8e9bb6e930dd43b8d277a659b515a38e17824e156d
Instruction ID: 0fbec59a06bd3f52036f95f3c639fd7bcf2563843e76adc57b5f875d908a98d0
Opcode Fuzzy Hash: 426a745d261e4c4a712e4b8e9bb6e930dd43b8d277a659b515a38e17824e156d
Instruction Fuzzy Hash: E8115131A50279B9D720B7A1EC4AEFF6ABCEBD1B44F400479B411A20D1EAB00A45C6B4

Function 00C25CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00C25CE2
GetWindowRect.USER32(00000000,?), ref: 00C25CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00C25D59
GetDlgItem.USER32(?,00000002), ref: 00C25D69
GetWindowRect.USER32(00000000,?), ref: 00C25D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00C25DCF
GetDlgItem.USER32(?,000003E9), ref: 00C25DDD
GetWindowRect.USER32(00000000,?), ref: 00C25DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00C25E31
GetDlgItem.USER32(?,000003EA), ref: 00C25E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00C25E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00C25E67

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 9ba0269ccec21aa5f591fd8e5004c8ef3e04d35c658c303978ef3d529355c413
Instruction ID: 835b4b5d4fbd0b4a9f7306d072d693e78023a2850b784b6623bc65684101ef66
Opcode Fuzzy Hash: 9ba0269ccec21aa5f591fd8e5004c8ef3e04d35c658c303978ef3d529355c413
Instruction Fuzzy Hash: 86510DB5A00715AFDB18CF68DD89BAEBBB5FB48301F148129F915E6690D7709E40CB50

Function 00BD8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00BD8BE8,?,00000000,?,?,?,?,00BD8BBA,00000000,?), ref: 00BD8FC5

DestroyWindow.USER32(?), ref: 00BD8C81
KillTimer.USER32(00000000,?,?,?,?,00BD8BBA,00000000,?), ref: 00BD8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00C16973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00BD8BBA,00000000,?), ref: 00C169A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00BD8BBA,00000000,?), ref: 00C169B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00BD8BBA,00000000), ref: 00C169D4
DeleteObject.GDI32(00000000), ref: 00C169E6

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 13af95989d3727ed81d8699156364ed2ef2894b55bf10b3b0cb2ee80f0e701cf
Instruction ID: 5e9fa9fafec9188f9de3ac18fb481fd92813212706c19fa2244808808d13fca3
Opcode Fuzzy Hash: 13af95989d3727ed81d8699156364ed2ef2894b55bf10b3b0cb2ee80f0e701cf
Instruction Fuzzy Hash: AD61AE34112701DFCB219F14D989B69BBF1FB41313F19459EE4529BAA0DB31AAC0EF90

Function 00BD9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00BD9944: GetWindowLongW.USER32(?,000000EB), ref: 00BD9952

GetSysColor.USER32(0000000F), ref: 00BD9862

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 887990153e7c3a540a41b37c0296798b4b02b488df02191ebf8b6218d119ffce
Instruction ID: 5454c5b73500e14ef715f1597e5bf8350a4e726bb926b70acf6cddedc8a4d51a
Opcode Fuzzy Hash: 887990153e7c3a540a41b37c0296798b4b02b488df02191ebf8b6218d119ffce
Instruction Fuzzy Hash: A041B2351047409FDB205F389C88BBE77A5EB06771F144656F9B2972E1E7319D81EB10

Function 00C550D4 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00C55186
ShowWindow.USER32(?,00000000), ref: 00C551C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00C551CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00C551D1

Part of subcall function 00C56FBA: DeleteObject.GDI32(00000000), ref: 00C56FE6

GetWindowLongW.USER32(?,000000F0), ref: 00C5520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C5521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00C5524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00C55287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00C55296

Strings

@U=u, xrefs: 00C55186

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID: @U=u
API String ID: 3210457359-2594219639
Opcode ID: 945ccc3c5ba657124a5629f63416356e3bf94956f2e89b47c4e5125f9449900f
Instruction ID: 75e64d369ec3c4adc1c5c8136fbf6af7b8389577a5a95f1cfe0ee5bbfdae700d
Opcode Fuzzy Hash: 945ccc3c5ba657124a5629f63416356e3bf94956f2e89b47c4e5125f9449900f
Instruction Fuzzy Hash: 1A51B638A40A08BEEF209F25CC59BDD3BA1EB05322F144012FD25962E1C771AAC8DF45

Function 00BD8B06 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00C16890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00C168A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00C168B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00C168D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00C168F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00BD8874,00000000,00000000,00000000,000000FF,00000000), ref: 00C16901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00C1691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00BD8874,00000000,00000000,00000000,000000FF,00000000), ref: 00C1692D

Strings

@U=u, xrefs: 00C168F2, 00C1691E

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID: @U=u
API String ID: 1268354404-2594219639
Opcode ID: 9dcaa7cf1f660f2ab6b6dfe24b05ea5f997fc64e0c18c23efbbc40aa6261a800
Instruction ID: 7c2693a27ffe20ddefe9390d5f8d1845a2d47e0c3271c8e0d83bc6560547ba24
Opcode Fuzzy Hash: 9dcaa7cf1f660f2ab6b6dfe24b05ea5f997fc64e0c18c23efbbc40aa6261a800
Instruction Fuzzy Hash: 81519E70600305EFDB20CF24CC95FAAB7F5EB48751F10451AF916972A0EB71EA90DB50

Function 00C296E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00C0F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00C29717
LoadStringW.USER32(00000000,?,00C0F7F8,00000001), ref: 00C29720

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00C0F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00C29742
LoadStringW.USER32(00000000,?,00C0F7F8,00000001), ref: 00C29745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00C29866

Strings

Line %d (File "%s"):, xrefs: 00C2978F
%s (%d) : ==> %s: %s %s, xrefs: 00C2984A
^ ERROR, xrefs: 00C297FB
Error: , xrefs: 00C2981D
Line %d:, xrefs: 00C297A0

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 97553f302981f1eb29edc454d710cd73227603c8018fbbb1d735e2ed2f87a05f
Instruction ID: 3df0ffa15a6987342e54c8f66eca8492ab6615e253a3224b2ec05b6fa09cfacf
Opcode Fuzzy Hash: 97553f302981f1eb29edc454d710cd73227603c8018fbbb1d735e2ed2f87a05f
Instruction Fuzzy Hash: A0414C72900219AADB04FBE0DD86FEEB3B8EF54740F5401A9F60572092EB356F48CB65

Function 00C206DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC6B57: _wcslen.LIBCMT ref: 00BC6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00C207A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00C207BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00C207DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00C20804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00C2082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C20837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C2083C

Strings

SOFTWARE\Classes\, xrefs: 00C2070E
\CLSID, xrefs: 00C20724
\IPC$, xrefs: 00C20784

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 717dc38bffa0b499fc2328e703e11be2772673ea615ec97b2f4cdc167b868bf8
Instruction ID: e42ef0bb72440ba4376cf8da76044d7b9c1ae0e57c919ba11781a809bee6e41f
Opcode Fuzzy Hash: 717dc38bffa0b499fc2328e703e11be2772673ea615ec97b2f4cdc167b868bf8
Instruction Fuzzy Hash: A4413A76C10228AFDF11EBA4DC85EEEB7B8FF44754B144169E911B31A1EB705E44CBA0

Function 00C21EDF Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

Part of subcall function 00C23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C23CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00C21F64
GetDlgCtrlID.USER32 ref: 00C21F6F
GetParent.USER32 ref: 00C21F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C21F8E
GetDlgCtrlID.USER32(?), ref: 00C21F97
GetParent.USER32(?), ref: 00C21FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C21FAE

Strings

ComboBox, xrefs: 00C21EEC
ListBox, xrefs: 00C21F21
@U=u, xrefs: 00C21FAE

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: @U=u$ComboBox$ListBox
API String ID: 711023334-2258501812
Opcode ID: 1964fc774d336cf09f8e0a49177889daf495c8dca10d87e1d1261a914d5da998
Instruction ID: 64401bcef4feace60a55714a25ee9bbc2cfc0825e7bb20acd9e0a6a8c75b850e
Opcode Fuzzy Hash: 1964fc774d336cf09f8e0a49177889daf495c8dca10d87e1d1261a914d5da998
Instruction Fuzzy Hash: F321CF74900224BFDF04AFA0DC85FFEBBB8EF19350B000159F961A72A1CB785A58DB64

Function 00C43C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C43C5C
CoInitialize.OLE32(00000000), ref: 00C43C8A
CoUninitialize.OLE32 ref: 00C43C94
_wcslen.LIBCMT ref: 00C43D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00C43DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00C43ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00C43F0E
CoGetObject.OLE32(?,00000000,00C5FB98,?), ref: 00C43F2D
SetErrorMode.KERNEL32(00000000), ref: 00C43F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00C43FC4
VariantClear.OLEAUT32(?), ref: 00C43FD8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 32479524d352fa9e6b93da9b5c29669cdef346a8c7a0b33cff3f5efb5b74477d
Instruction ID: 5ef2c1950f34d793e6cc90b1428b4f4d8778f3b167ea8f436d5ba96c09a009f9
Opcode Fuzzy Hash: 32479524d352fa9e6b93da9b5c29669cdef346a8c7a0b33cff3f5efb5b74477d
Instruction Fuzzy Hash: 51C13371608341AFD700DF68C884A2BBBE9FF89744F10495DF98A9B251DB31EE45CB52

Function 00C37A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C37AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00C37B8F
SHGetDesktopFolder.SHELL32(?), ref: 00C37BA3
CoCreateInstance.OLE32(00C5FD08,00000000,00000001,00C86E6C,?), ref: 00C37BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00C37C74
CoTaskMemFree.OLE32(?,?), ref: 00C37CCC
SHBrowseForFolderW.SHELL32(?), ref: 00C37D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00C37D7A
CoTaskMemFree.OLE32(00000000), ref: 00C37D81
CoTaskMemFree.OLE32(00000000), ref: 00C37DD6
CoUninitialize.OLE32 ref: 00C37DDC

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 107a9b7248863a75bf4d4a30967aaea61b290ac1f67a976818f90c05248b0b66
Instruction ID: 0aece7156aba7229602e21cba47c4ce64486b800d6fd7b5875bdff5a8c6f83b4
Opcode Fuzzy Hash: 107a9b7248863a75bf4d4a30967aaea61b290ac1f67a976818f90c05248b0b66
Instruction Fuzzy Hash: A0C10C75A14209AFDB14DF64C888EAEBBF9FF48304F148599E8159B361D730EE45CB90

Function 00C1FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00C1FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00C1FB08
VariantInit.OLEAUT32(?), ref: 00C1FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00C1FB3A
VariantCopy.OLEAUT32(?,?), ref: 00C1FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00C1FBA1
VariantClear.OLEAUT32(?), ref: 00C1FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00C1FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C1FBCC
VariantClear.OLEAUT32(?), ref: 00C1FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C1FBE9

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 83723378de828f8b386c9a482c9930b5b96816d21c37e399e19ba5c072afd1ae
Instruction ID: 80107bc3964963686cc9292eeee0a87f926642bf82b8fffbbe881a7827750f54
Opcode Fuzzy Hash: 83723378de828f8b386c9a482c9930b5b96816d21c37e399e19ba5c072afd1ae
Instruction Fuzzy Hash: 01414275A003199FCB00DF64C898EFEBBB9FF49345F008069E955A7261D734A986DF90

Function 00C29C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00C29CA1
GetAsyncKeyState.USER32(000000A0), ref: 00C29D22
GetKeyState.USER32(000000A0), ref: 00C29D3D
GetAsyncKeyState.USER32(000000A1), ref: 00C29D57
GetKeyState.USER32(000000A1), ref: 00C29D6C
GetAsyncKeyState.USER32(00000011), ref: 00C29D84
GetKeyState.USER32(00000011), ref: 00C29D96
GetAsyncKeyState.USER32(00000012), ref: 00C29DAE
GetKeyState.USER32(00000012), ref: 00C29DC0
GetAsyncKeyState.USER32(0000005B), ref: 00C29DD8
GetKeyState.USER32(0000005B), ref: 00C29DEA

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 14af474042d5ca72f9adea5adc98752609e23969e609407577812bf521a459c8
Instruction ID: 5145ef3713ec345e12f82bc7d1996c0b570bdaa8de44327c1263e156eca63a36
Opcode Fuzzy Hash: 14af474042d5ca72f9adea5adc98752609e23969e609407577812bf521a459c8
Instruction Fuzzy Hash: 1141F6345047E96DFF308664E8443B5BEA0EF11304F44805ADAD6669C2EBB49BC8D7A2

Function 00C4055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00C405BC
inet_addr.WSOCK32(?), ref: 00C4061C
gethostbyname.WSOCK32(?), ref: 00C40628
IcmpCreateFile.IPHLPAPI ref: 00C40636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00C406C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00C406E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00C407B9
WSACleanup.WSOCK32 ref: 00C407BF

Strings

Ping, xrefs: 00C40676

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: ee530d40792631d8a501e85dacd81870a840f60fdeb1efd36a0888b48cb30d10
Instruction ID: 82d1a9d5edeb26a5cf7d3d0f68048d3de0554b89bd7a5266b18ca52b2dd07ca0
Opcode Fuzzy Hash: ee530d40792631d8a501e85dacd81870a840f60fdeb1efd36a0888b48cb30d10
Instruction Fuzzy Hash: DB915B356483019FD720DF15C489F1ABBE0BF48318F2585A9F56A9B6A2C730ED85CF92

Function 00C48CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00C48CF3

Part of subcall function 00C28E54: _wcslen.LIBCMT ref: 00C28E77

_wcslen.LIBCMT ref: 00C48D4E
_wcslen.LIBCMT ref: 00C48D9C
_wcslen.LIBCMT ref: 00C48DDC
_wcslen.LIBCMT ref: 00C48E6E

Strings

none, xrefs: 00C48E65, 00C48E6A
cdecl, xrefs: 00C48D48, 00C48D4D
stdcall, xrefs: 00C48DD6, 00C48DDB
winapi, xrefs: 00C48D96, 00C48D9B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 1ae47e39052cbf92892deb1661de0780bba72f6006add0b8849a779d259611f3
Instruction ID: f78862eb9d596c940aa7dbfaed14a254d4efc5bdc156a8e863b0a8735e2a94b3
Opcode Fuzzy Hash: 1ae47e39052cbf92892deb1661de0780bba72f6006add0b8849a779d259611f3
Instruction Fuzzy Hash: 5C519F35A011179BCF24EF6CC9409BEB7E5BF65724B204269E826E72C5EB31DE48C790

Function 00C4372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00C43774
CoUninitialize.OLE32 ref: 00C4377F
CoCreateInstance.OLE32(?,00000000,00000017,00C5FB78,?), ref: 00C437D9
IIDFromString.OLE32(?,?), ref: 00C4384C
VariantInit.OLEAUT32(?), ref: 00C438E4
VariantClear.OLEAUT32(?), ref: 00C43936

Strings

Invalid parameter, xrefs: 00C43865
NULL Pointer assignment, xrefs: 00C4381E
Failed to create object, xrefs: 00C437E4, 00C4389A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: ede784f9e36c5046fa71e9205fe9ef5d4658ff0723b73b76b31f1ce4500a2819
Instruction ID: e7458aba6d46a15264e35b2dc85b4d96641407b929a4f37faec286579b366d00
Opcode Fuzzy Hash: ede784f9e36c5046fa71e9205fe9ef5d4658ff0723b73b76b31f1ce4500a2819
Instruction Fuzzy Hash: 33619B70608341AFD310DF54C889F6ABBE8FF88715F10095AF8959B291D770EE88CB92

Function 00BC5BEA Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00BC5C7A

Part of subcall function 00BC5D0A: GetClientRect.USER32(?,?), ref: 00BC5D30
Part of subcall function 00BC5D0A: GetWindowRect.USER32(?,?), ref: 00BC5D71
Part of subcall function 00BC5D0A: ScreenToClient.USER32(?,?), ref: 00BC5D99

GetDC.USER32 ref: 00C046F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00C04708
SelectObject.GDI32(00000000,00000000), ref: 00C04716
SelectObject.GDI32(00000000,00000000), ref: 00C0472B
ReleaseDC.USER32(?,00000000), ref: 00C04733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00C047C4

Strings

@U=u, xrefs: 00C04708
U, xrefs: 00C04693

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: @U=u$U
API String ID: 4009187628-4110099822
Opcode ID: 4ca40d18e88f358eb3f902fadb4e11d00f7798e2565bf5147f3f5941808fa63a
Instruction ID: d81817bae13bc114a016ef65d154a2a119238b81ee9beba815e1bf76c6eb18f5
Opcode Fuzzy Hash: 4ca40d18e88f358eb3f902fadb4e11d00f7798e2565bf5147f3f5941808fa63a
Instruction Fuzzy Hash: BD71FF74400205DFCF298F68C984FAB3BB5FF4A311F144269EE615A2A6D3319A81DF50

Function 00C58B02 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BD9BB2

Part of subcall function 00BD912D: GetCursorPos.USER32(?), ref: 00BD9141
Part of subcall function 00BD912D: ScreenToClient.USER32(00000000,?), ref: 00BD915E
Part of subcall function 00BD912D: GetAsyncKeyState.USER32(00000001), ref: 00BD9183
Part of subcall function 00BD912D: GetAsyncKeyState.USER32(00000002), ref: 00BD919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00C58B6B
ImageList_EndDrag.COMCTL32 ref: 00C58B71
ReleaseCapture.USER32 ref: 00C58B77
SetWindowTextW.USER32(?,00000000), ref: 00C58C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00C58C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00C58CFF

Strings

@GUI_DROPID, xrefs: 00C58C51
@U=u, xrefs: 00C58C25
@GUI_DRAGFILE, xrefs: 00C58C9A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$@U=u
API String ID: 1924731296-2104563098
Opcode ID: e9568b6af342abbd79f730519a292a504190d04e424ea9db5e4ae10df03be91d
Instruction ID: 77e3f1687c7a6f236aced1fd6ef0b30603e99f4b8ad3c1a9d72f49de09ee250d
Opcode Fuzzy Hash: e9568b6af342abbd79f730519a292a504190d04e424ea9db5e4ae10df03be91d
Instruction Fuzzy Hash: 6B518B74104300AFD704DF14CC9AFAE77E4EB84755F00066DF956672E1DB70AA88CB66

Function 00C33388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00C333CF

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00C333F0

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00C33504
"%s" (%d) : ==> %s:, xrefs: 00C33522
Line %d (File "%s"):, xrefs: 00C33443, 00C3345C
Error: , xrefs: 00C334D1
Incorrect parameters to object property !, xrefs: 00C334AB
^ ERROR , xrefs: 00C3349E

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 3bb8efcc905735fdd13e4a3be3d5c423c255cf32b719375d9eb630ccdaf8cff2
Instruction ID: ee995239240e266fccffec31ad826c44b61eb8acd26f766b733d521a2c75342a
Opcode Fuzzy Hash: 3bb8efcc905735fdd13e4a3be3d5c423c255cf32b719375d9eb630ccdaf8cff2
Instruction Fuzzy Hash: E1518D3190024AAADF15EBA0DD46FEEB7B8EF04744F1441A9F505720A2EB316F98DB64

Function 00C2B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C2B5FC
_wcslen.LIBCMT ref: 00C2B608
_wcslen.LIBCMT ref: 00C2B64D
_wcslen.LIBCMT ref: 00C2B68C
_wcslen.LIBCMT ref: 00C2B6C7

Strings

EXISTS, xrefs: 00C2B686, 00C2B68B
KEYS, xrefs: 00C2B647, 00C2B64C
APPEND, xrefs: 00C2B6C1, 00C2B6C6
REMOVE, xrefs: 00C2B602, 00C2B607

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 78606fe6540241c0be58587144319025e9547f3fc5d37b5de656430bd460d78e
Instruction ID: e182a8f52695fbb4f8d8f52e035f824635befcf86c4e858d6245934992502811
Opcode Fuzzy Hash: 78606fe6540241c0be58587144319025e9547f3fc5d37b5de656430bd460d78e
Instruction Fuzzy Hash: CA41B632A001379ACB246F7D98905BEB7B5BF60B58B244169F476D7684E731CE81C790

Function 00C35393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C353A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00C35416
GetLastError.KERNEL32 ref: 00C35420
SetErrorMode.KERNEL32(00000000,READY), ref: 00C354A7

Strings

UNKNOWN, xrefs: 00C35444
READONLY, xrefs: 00C35452
INVALID, xrefs: 00C35459
NOTREADY, xrefs: 00C3544B
READY, xrefs: 00C35460, 00C35468

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 48654281d84c59ec1e01af9f1055713248ad8430656e69b85e56e64e52a12eb7
Instruction ID: 944499aefeb61d908fb67926d6a744d4c1f7df522774e26085eda7057dda999d
Opcode Fuzzy Hash: 48654281d84c59ec1e01af9f1055713248ad8430656e69b85e56e64e52a12eb7
Instruction Fuzzy Hash: 6531A175A106049FDB14DF68C884FAEBBF4EF45309F148069E815DB2A2DB71DE86CB90

Function 00C53C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00C53C79
SetMenu.USER32(?,00000000), ref: 00C53C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C53D10
IsMenu.USER32(?), ref: 00C53D24
CreatePopupMenu.USER32 ref: 00C53D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C53D5B
DrawMenuBar.USER32 ref: 00C53D63

Strings

0, xrefs: 00C53C54
F, xrefs: 00C53D4E

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: ffb64ea74694cdf705af087775860df2734684e6a93f81284ef66f08712ac185
Instruction ID: db3f81edff36b1caaf75d395b0cd323fc62fcdb9112403cb87c1e5e78cbbca92
Opcode Fuzzy Hash: ffb64ea74694cdf705af087775860df2734684e6a93f81284ef66f08712ac185
Instruction Fuzzy Hash: 2F417B79A01309AFDB14CFA4D888B9E77B5FF49391F140029ED16A7360D730AA54CF94

Function 00C52D03 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C52D1B
GetDC.USER32(00000000), ref: 00C52D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C52D2E
ReleaseDC.USER32(00000000,00000000), ref: 00C52D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00C52D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00C52D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00C55A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00C52DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00C52DE1

Strings

@U=u, xrefs: 00C52D87, 00C52DE1

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID: @U=u
API String ID: 3864802216-2594219639
Opcode ID: ffc19e9b9b5277e70ce086aaaf0e4caa596a0ffa987f2c438458c6f0a8d1c92b
Instruction ID: 5fd84d49709a385f59ba9fa5122fd1214a4682140eeb5cdb4b60c79712aa170c
Opcode Fuzzy Hash: ffc19e9b9b5277e70ce086aaaf0e4caa596a0ffa987f2c438458c6f0a8d1c92b
Instruction Fuzzy Hash: F5317F7A201314BFEB114F50CC8AFEB3BA9EF4A756F044055FE08AA291C6759D90CBA4

Function 00C2209F Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00C220AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00C220C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00C2214D

Strings

list, xrefs: 00C2212F
SHELLDLL_DefView, xrefs: 00C220CC
largeicons, xrefs: 00C220E1
smallicons, xrefs: 00C22115
details, xrefs: 00C220FB
@U=u, xrefs: 00C2214D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: @U=u$SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-1428604138
Opcode ID: 9c668302cea20bede5f64322afd6161b9801cbadb6c8a1c50d3f61f7bbb1b834
Instruction ID: 15f34b3f5f5cd283aff27442c60ce375147e74279563a37d05d02698b27bf26b
Opcode Fuzzy Hash: 9c668302cea20bede5f64322afd6161b9801cbadb6c8a1c50d3f61f7bbb1b834
Instruction Fuzzy Hash: F011367A688316BAF6013221EC06EFE37ECCF14328B201076FB04A54D1FFA16D615618

Function 00C53A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00C53A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00C53AA0
GetWindowLongW.USER32(?,000000F0), ref: 00C53AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C53AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00C53B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00C53BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00C53BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00C53BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00C53BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00C53C13

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 54f716b3dd564e7d03b7211242eb96fd699737ed44b9456004bdc9e3daf6343e
Instruction ID: d838400f781a6851b2b015877fbf14da98639196a9303f05339b8cb6a20c6900
Opcode Fuzzy Hash: 54f716b3dd564e7d03b7211242eb96fd699737ed44b9456004bdc9e3daf6343e
Instruction Fuzzy Hash: A8618A79900248AFDB11DFA8CC81FEE77B8EB09310F14019AFA15A72A1C770AE85DB54

Function 00C2B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C2B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00C2A1E1,?,00000001), ref: 00C2B165
GetWindowThreadProcessId.USER32(00000000), ref: 00C2B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C2A1E1,?,00000001), ref: 00C2B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C2B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00C2A1E1,?,00000001), ref: 00C2B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C2A1E1,?,00000001), ref: 00C2B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00C2A1E1,?,00000001), ref: 00C2B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00C2A1E1,?,00000001), ref: 00C2B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00C2A1E1,?,00000001), ref: 00C2B21D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 7e2519082206c1deab0fa3a543ac13bd564355a77450d820965a3a28067018b8
Instruction ID: 4cbf94ce257e3383c2bbc9a6de89522438e45c8a655ea9279a5cc36ad0c8a1c6
Opcode Fuzzy Hash: 7e2519082206c1deab0fa3a543ac13bd564355a77450d820965a3a28067018b8
Instruction Fuzzy Hash: 9F318975510314EFDB109F28EC88BAE7BA9AB51312F104006FA25E6591DBB89F80CF60

Function 00BF2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF2C94

Part of subcall function 00BF29C8: HeapFree.KERNEL32(00000000,00000000,?,00BFD7D1,00000000,00000000,00000000,00000000,?,00BFD7F8,00000000,00000007,00000000,?,00BFDBF5,00000000), ref: 00BF29DE
Part of subcall function 00BF29C8: GetLastError.KERNEL32(00000000,?,00BFD7D1,00000000,00000000,00000000,00000000,?,00BFD7F8,00000000,00000007,00000000,?,00BFDBF5,00000000,00000000), ref: 00BF29F0

_free.LIBCMT ref: 00BF2CA0
_free.LIBCMT ref: 00BF2CAB
_free.LIBCMT ref: 00BF2CB6
_free.LIBCMT ref: 00BF2CC1
_free.LIBCMT ref: 00BF2CCC
_free.LIBCMT ref: 00BF2CD7
_free.LIBCMT ref: 00BF2CE2
_free.LIBCMT ref: 00BF2CED
_free.LIBCMT ref: 00BF2CFB

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4c874995dcbf3c1a27dbad4320840e4fbf9f0d6e08be828e64a9b5765ff5b9d3
Instruction ID: 0d19f5b8ca959c4f6de5d7fde214ff4da652d5922ca75ceb46e151387212442b
Opcode Fuzzy Hash: 4c874995dcbf3c1a27dbad4320840e4fbf9f0d6e08be828e64a9b5765ff5b9d3
Instruction Fuzzy Hash: DC11A47614010DAFCB02EF94D882CED3BA5FF05350F4184A5FA489F322DA71EE549B90

Function 00BC1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00BC1459
OleUninitialize.OLE32(?,00000000), ref: 00BC14F8
UnregisterHotKey.USER32(?), ref: 00BC16DD
DestroyWindow.USER32(?), ref: 00C024B9
FreeLibrary.KERNEL32(?), ref: 00C0251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00C0254B

Strings

close all, xrefs: 00BC1454

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 1b974fe797af0f73a5c70ab254ec5c513e7b1e5309fbea225b8b2e91f73efcab
Instruction ID: 3221c995d1f9bcc5428abf266671c46294661ab981ed39375da9c614e0f4205f
Opcode Fuzzy Hash: 1b974fe797af0f73a5c70ab254ec5c513e7b1e5309fbea225b8b2e91f73efcab
Instruction Fuzzy Hash: AFD138717012128FDB19EF19C899F29F7A4BF05700F1446EEE84AAB292DB31AD52CF54

Function 00C37DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C37FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00C37FC1
GetFileAttributesW.KERNEL32(?), ref: 00C37FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00C38005
SetCurrentDirectoryW.KERNEL32(?), ref: 00C38017
SetCurrentDirectoryW.KERNEL32(?), ref: 00C38060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00C380B0

Strings

*.*, xrefs: 00C38066

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: b78da106a8c9d1006274e167049baf7b617ed51feea25bff97097e6e1f4e1de4
Instruction ID: b9b47fdc881d379ea2b9da9af93177588e0705aadd4943dc98f9953c165e0f7e
Opcode Fuzzy Hash: b78da106a8c9d1006274e167049baf7b617ed51feea25bff97097e6e1f4e1de4
Instruction Fuzzy Hash: 9A81A0B15283419FCB34EF15C884AAEB3E8BF88310F14495EF895D7250EB34DE498B52

Function 00C57E9E Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(019352F8), ref: 00C57F37
IsWindowEnabled.USER32(019352F8), ref: 00C57F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00C5801E
SendMessageW.USER32(019352F8,000000B0,?,?), ref: 00C58051
IsDlgButtonChecked.USER32(?,?), ref: 00C58089
GetWindowLongW.USER32(019352F8,000000EC), ref: 00C580AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00C580C3

Strings

@U=u, xrefs: 00C5801E, 00C58051, 00C580C3

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID: @U=u
API String ID: 4072528602-2594219639
Opcode ID: a5f43f154f764b1375397437b0114b932d096c662a1ee7978c3482103b91a10d
Instruction ID: dbbef1845e1a35df94c0c480c75f6b021d505673090ab2ae82dc81dc6e3d821c
Opcode Fuzzy Hash: a5f43f154f764b1375397437b0114b932d096c662a1ee7978c3482103b91a10d
Instruction Fuzzy Hash: FA71C338508204AFEF21DF94DC85FAA7BB5EF49302F140259FD5563291CB31AAC9DB14

Function 00C3359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00C335E4

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

LoadStringW.USER32(00C92390,?,00000FFF,?), ref: 00C3360A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00C33724
"%s" (%d) : ==> %s:, xrefs: 00C33742
Line %d (File "%s"):, xrefs: 00C3366B
^ ERROR, xrefs: 00C336C9
Error: , xrefs: 00C336EF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: d0e0892b9c237cf4a8a7b62d0f18fcef48f425c83aebfb9e1dd57bb18ae8da30
Instruction ID: f18db93371c6809fd7b59e57997673336ebb2e32330c14b5e632bfd475c75af7
Opcode Fuzzy Hash: d0e0892b9c237cf4a8a7b62d0f18fcef48f425c83aebfb9e1dd57bb18ae8da30
Instruction Fuzzy Hash: 39517E7190024ABADF14EBA0DD46FEEBBB8EF04740F144169F515721A1EB305B98DF64

Function 00C53886 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00C53925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00C5393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00C53954
_wcslen.LIBCMT ref: 00C53999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00C539C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00C539F4

Strings

SysListView32, xrefs: 00C538F7
@U=u, xrefs: 00C53925, 00C5393A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: @U=u$SysListView32
API String ID: 2147712094-1908207174
Opcode ID: 13f7da0c0963e483adf20099d4b0c53ddf37928d9d36496cf60c8ff100adfba5
Instruction ID: 795ade941daa488c2df64881dc2bb2175ab780ac401034fed0a6b998e3f1e179
Opcode Fuzzy Hash: 13f7da0c0963e483adf20099d4b0c53ddf37928d9d36496cf60c8ff100adfba5
Instruction Fuzzy Hash: 2841C275A00319ABEF219F64CC49BEE77A9EF08391F100526F958E7281D7709AC4CB94

Function 00C52DFD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00C52E1C
GetWindowLongW.USER32(?,000000F0), ref: 00C52E4F
GetWindowLongW.USER32(?,000000F0), ref: 00C52E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00C52EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00C52EE0
GetWindowLongW.USER32(?,000000F0), ref: 00C52EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C52F0B

Strings

@U=u, xrefs: 00C52E1C, 00C52EB6, 00C52EE0

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: @U=u
API String ID: 2178440468-2594219639
Opcode ID: 48b68da01cab9c12acac4d40f5a3e3fb3f0370c4a999e65b502ff191530b5d65
Instruction ID: 6292cab48023f779e081cbabc759d4f00f4e9e4e5fa1f8a9339ee1f8c09806a4
Opcode Fuzzy Hash: 48b68da01cab9c12acac4d40f5a3e3fb3f0370c4a999e65b502ff191530b5d65
Instruction Fuzzy Hash: 133115386042519FDB21CF58DC8AF6937E0EB5A722F190165F9109F2B1CBB1AD84DB04

Function 00C3C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C3C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C3C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00C3C2CA
GetLastError.KERNEL32 ref: 00C3C322
SetEvent.KERNEL32(?), ref: 00C3C336
InternetCloseHandle.WININET(00000000), ref: 00C3C341

Strings

, xrefs: 00C3C2BB

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 82acd90e3aff7b88416cc89a5a74ba0dc0e300cf1bfc44e05323198affb9107d
Instruction ID: 1eceb9a9f28f994b1685446200fb1313acc41bee47e18697a6342596abffc932
Opcode Fuzzy Hash: 82acd90e3aff7b88416cc89a5a74ba0dc0e300cf1bfc44e05323198affb9107d
Instruction Fuzzy Hash: BB3178B1610308AFD7219FA58CC8BAF7BECEB49784F10851AF456A2210DB34DA449BA0

Function 00C2989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00C03AAF,?,?,Bad directive syntax error,00C5CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00C298BC
LoadStringW.USER32(00000000,?,00C03AAF,?), ref: 00C298C3

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00C29987

Strings

Line %d (File "%s"):, xrefs: 00C2992D
., xrefs: 00C2996D
%s (%d) : ==> %s.: %s %s, xrefs: 00C298F1
Error: , xrefs: 00C29955
Line %d:, xrefs: 00C29912

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: b4fb7529c911f02e986831cd4edf5e217a3d367ae3ac471b6ccbcbeda80a5f49
Instruction ID: 0913653fb26735b74d6bef9eabc27206b671c69569c3c10889d4150081d58fd1
Opcode Fuzzy Hash: b4fb7529c911f02e986831cd4edf5e217a3d367ae3ac471b6ccbcbeda80a5f49
Instruction Fuzzy Hash: 92217C3190021AABDF11EF90DC4AFEE77B5FF18704F0844AAF519660A2EB319658DB24

Function 00BF8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac0c522b2fbc470e3b9586e02ff323a33f2c163c17e3135cc99e12a45ae70cb
Instruction ID: 60bca545db091320626643911aae4aaad93b441b674adf4368ddcaef09b24937
Opcode Fuzzy Hash: 6ac0c522b2fbc470e3b9586e02ff323a33f2c163c17e3135cc99e12a45ae70cb
Instruction Fuzzy Hash: D9C1DE75A0424DAFDB119FA8D885BBDBBF0EF09310F1440D9FA14A7392CB318949CB61

Function 00BFCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00BFCEB7
_free.LIBCMT ref: 00BFCF22
_free.LIBCMT ref: 00BFCF48
_free.LIBCMT ref: 00BFCF71
_free.LIBCMT ref: 00BFCFA9
_free.LIBCMT ref: 00BFCFDA
_free.LIBCMT ref: 00BFD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00BFD09C
_free.LIBCMT ref: 00BFD0B5

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 9a0c6daad56fa582ccdc574082f32c4be5fca1e433b86b3448d9e0303ebf8942
Instruction ID: e3ad3eac5864cc9239ef17f5d0f9f86a48d122fbc2c8a6dd31ac5861464fb53a
Opcode Fuzzy Hash: 9a0c6daad56fa582ccdc574082f32c4be5fca1e433b86b3448d9e0303ebf8942
Instruction Fuzzy Hash: 7061F37290420DAFDB21AFB49985B7EBFE5EF05310F1441EAFB4197281DB31994D8790

Function 00C3C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C3C182
GetLastError.KERNEL32 ref: 00C3C195
SetEvent.KERNEL32(?), ref: 00C3C1A9

Part of subcall function 00C3C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C3C272
Part of subcall function 00C3C253: GetLastError.KERNEL32 ref: 00C3C322
Part of subcall function 00C3C253: SetEvent.KERNEL32(?), ref: 00C3C336
Part of subcall function 00C3C253: InternetCloseHandle.WININET(00000000), ref: 00C3C341

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 48670161c7b8deb8bbb7b1f63441d14ced2f5af022f6b6383c3aed43fcff8c59
Instruction ID: 6c9526e47e812f96bf8c208b422034844c7bd1cc8072d762f9e00db25355d213
Opcode Fuzzy Hash: 48670161c7b8deb8bbb7b1f63441d14ced2f5af022f6b6383c3aed43fcff8c59
Instruction Fuzzy Hash: CE317875210705AFDB219FA5DC84B6FBBE8FF18341F00442DF966A6620D732E954EBA0

Function 00C225A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C23A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C23A57
Part of subcall function 00C23A3D: GetCurrentThreadId.KERNEL32 ref: 00C23A5E
Part of subcall function 00C23A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00C225B3), ref: 00C23A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00C225BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00C225DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00C225DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00C225E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00C22601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00C22605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00C2260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00C22623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00C22627

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: d775ab173be03162c510573011ac44e034893b5bd46c309d7a5ef109835a9f8b
Instruction ID: 53aae02d5222786a53e4efe79452ceda73c55f14f4cd6e2241dcdfc105722615
Opcode Fuzzy Hash: d775ab173be03162c510573011ac44e034893b5bd46c309d7a5ef109835a9f8b
Instruction Fuzzy Hash: FB01D431390720BBFB2067699CCAF5E3F99DB4EB12F100012F318BE1D1C9E224849A69

Function 00C21803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00C21449,?,?,00000000), ref: 00C2180C
HeapAlloc.KERNEL32(00000000,?,00C21449,?,?,00000000), ref: 00C21813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00C21449,?,?,00000000), ref: 00C21828
GetCurrentProcess.KERNEL32(?,00000000,?,00C21449,?,?,00000000), ref: 00C21830
DuplicateHandle.KERNEL32(00000000,?,00C21449,?,?,00000000), ref: 00C21833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00C21449,?,?,00000000), ref: 00C21843
GetCurrentProcess.KERNEL32(00C21449,00000000,?,00C21449,?,?,00000000), ref: 00C2184B
DuplicateHandle.KERNEL32(00000000,?,00C21449,?,?,00000000), ref: 00C2184E
CreateThread.KERNEL32(00000000,00000000,00C21874,00000000,00000000,00000000), ref: 00C21868

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 6e44532c929099676d37210efdaab3509ef811288a344403fc2e8a396b73fe5b
Instruction ID: 6fb8b1559b0a271dc072f15e36ee700c35aeae56b53444f9a74759c9493f90fe
Opcode Fuzzy Hash: 6e44532c929099676d37210efdaab3509ef811288a344403fc2e8a396b73fe5b
Instruction Fuzzy Hash: 0401BBB9640708BFE710ABB5DC8DF6F3BACEB89B11F014411FA05EB1A1CA709850CB20

Function 00C4A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00C2D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00C2D501
Part of subcall function 00C2D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00C2D50F
Part of subcall function 00C2D4DC: CloseHandle.KERNEL32(00000000), ref: 00C2D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C4A16D
GetLastError.KERNEL32 ref: 00C4A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C4A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00C4A268
GetLastError.KERNEL32(00000000), ref: 00C4A273
CloseHandle.KERNEL32(00000000), ref: 00C4A2C4

Strings

SeDebugPrivilege, xrefs: 00C4A18F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: b42e835891b61dff12e559f9fa8acb1223f44910ab3dcc50ba84f0b7a4ca2aa8
Instruction ID: 45b263a84d16751af76a14a6467b5bda226d384f2779be629e651ee56867e7e2
Opcode Fuzzy Hash: b42e835891b61dff12e559f9fa8acb1223f44910ab3dcc50ba84f0b7a4ca2aa8
Instruction Fuzzy Hash: 866180742442429FD720DF19C494F1ABBE1BF54318F14849CE46A8B7A3C7B2ED45DB92

Function 00C2BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C2BCFD
IsMenu.USER32(00000000), ref: 00C2BD1D
CreatePopupMenu.USER32 ref: 00C2BD53
GetMenuItemCount.USER32(019355A0), ref: 00C2BDA4
InsertMenuItemW.USER32(019355A0,?,00000001,00000030), ref: 00C2BDCC

Strings

2, xrefs: 00C2BD37
0, xrefs: 00C2BCA8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: b17a500e4159703993560d6151994fa88a4b31be1a3f2f164b3d66793c113f2f
Instruction ID: b65f150ef434bcba560ab17aefc077c1858d3e953cbbdb1bc72a4acfc4aec024
Opcode Fuzzy Hash: b17a500e4159703993560d6151994fa88a4b31be1a3f2f164b3d66793c113f2f
Instruction Fuzzy Hash: 2851AD70A003259BDF10CFA9E8C8BEEBBF4BF45314F148159E461A7699E770AE41CB61

Function 00C581DB Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00C1F3AB,00000000,?,?,00000000,?,00C1682C,00000004,00000000,00000000), ref: 00C5824C
EnableWindow.USER32(?,00000000), ref: 00C58272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00C582D1
ShowWindow.USER32(?,00000004), ref: 00C582E5
EnableWindow.USER32(?,00000001), ref: 00C5830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00C5832F

Strings

@U=u, xrefs: 00C5832F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID: @U=u
API String ID: 642888154-2594219639
Opcode ID: 93a53dea6aabc081773697914c83b43e7e12d7722dfbcd7064c4e783ca77e744
Instruction ID: 8bb2d2ba33baa39206582847d9269a6f8057d1e406e3a3784db3116c0a2de764
Opcode Fuzzy Hash: 93a53dea6aabc081773697914c83b43e7e12d7722dfbcd7064c4e783ca77e744
Instruction Fuzzy Hash: F941C638601740AFDF12CF14CC9ABA87BE0BB09716F184165ED18AB272CB31698DCB44

Function 00C24C7D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00C24C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00C24CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00C24CEA
_wcslen.LIBCMT ref: 00C24D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00C24D10
_wcsstr.LIBVCRUNTIME ref: 00C24D1A

Strings

@U=u, xrefs: 00C24CB2, 00C24CEA

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID: @U=u
API String ID: 72514467-2594219639
Opcode ID: d686bb522cebba9c0bb1498acc78bc2ffd7bfc9bfdbdf258fb2b50a25ef57b1c
Instruction ID: 7101fd6ed5ff2552dba543eed2df026f04ad4e3a30183a721a1735ac58128fbc
Opcode Fuzzy Hash: d686bb522cebba9c0bb1498acc78bc2ffd7bfc9bfdbdf258fb2b50a25ef57b1c
Instruction Fuzzy Hash: 1A21D735204211BBEB195B3AEC49F7F7BECDF45750F10407AF805DA192EE61DE4096A0

Function 00C2C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00C2C913

Strings

warning, xrefs: 00C2C8FC
blank, xrefs: 00C2C895
stop, xrefs: 00C2C8E4
info, xrefs: 00C2C8B4
question, xrefs: 00C2C8CC

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: f26b8f25ce68524b7d1f973cdfc61f202faa9eacffd1d926366e0cf690675ca9
Instruction ID: e5508e8b21e4c68ff092c1cfe82c9b9fc03e36a12873f97fa037f25090f80c8d
Opcode Fuzzy Hash: f26b8f25ce68524b7d1f973cdfc61f202faa9eacffd1d926366e0cf690675ca9
Instruction Fuzzy Hash: 2E113D32689316BAE7007B55BCC3DAE27DCDF15368B10003AF500A65C2D7B05F8053AC

Function 00C17439 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00C17452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00C17469
GetWindowDC.USER32(?), ref: 00C17475
GetPixel.GDI32(00000000,?,?), ref: 00C17484
ReleaseDC.USER32(?,00000000), ref: 00C17496
GetSysColor.USER32(00000005), ref: 00C174B0

Strings

@U=u, xrefs: 00C17469

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID: @U=u
API String ID: 272304278-2594219639
Opcode ID: 3a44425b9c3654c57fc254f0b7158f5b9c1af24a1f0f78c6e5b68b7516458b26
Instruction ID: 1c98cbbac2b57ad3de3075492d72acd79f4a43d9ac3d7081d9fdc068dc7b7bde
Opcode Fuzzy Hash: 3a44425b9c3654c57fc254f0b7158f5b9c1af24a1f0f78c6e5b68b7516458b26
Instruction Fuzzy Hash: AD012435400315EFEB519FA4DC89BEE7BB5FB04322F650164F926A21A1CB311E91EF50

Function 00C2ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00C2ED2A
_wcslen.LIBCMT ref: 00C2ED3B
_wcslen.LIBCMT ref: 00C2ED79
_wcslen.LIBCMT ref: 00C2EDAF
_wcslen.LIBCMT ref: 00C2EDDF
_wcslen.LIBCMT ref: 00C2EDEF
_wcslen.LIBCMT ref: 00C2EE2B
_wcslen.LIBCMT ref: 00C2EE5A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 469fd50f2551047c10910d45445d01250cb74a912556a075d326cbaf8a8f14b9
Instruction ID: 9972843c14c5cefb412fb7b5806d37f15ac4eeff9a6ca6e3b8e8cb5f2db59756
Opcode Fuzzy Hash: 469fd50f2551047c10910d45445d01250cb74a912556a075d326cbaf8a8f14b9
Instruction Fuzzy Hash: 4C41A265C1026875CB11EBF5C88A9CFB7E8AF45310F5084A6E614F3522FB34E645C3E6

Function 00BDF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00C1682C,00000004,00000000,00000000), ref: 00BDF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00C1682C,00000004,00000000,00000000), ref: 00C1F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00C1682C,00000004,00000000,00000000), ref: 00C1F454

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: a3724689617b98f7006b0ac16a0f372a48a20721871ed9722aaa7e88a7327633
Instruction ID: 5ab156b11c9ea49c0f121b3343b8fb1ab1b8a7ac7b7795c79043e1a2c76bdce2
Opcode Fuzzy Hash: a3724689617b98f7006b0ac16a0f372a48a20721871ed9722aaa7e88a7327633
Instruction Fuzzy Hash: 4B412A30A0C781BEC7398B2988E877AFBD1EB46310F54447EE09B56760E67AE9C1D711

Function 00C25622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00C25637
_memcmp.LIBVCRUNTIME ref: 00C25659
_memcmp.LIBVCRUNTIME ref: 00C25671
_memcmp.LIBVCRUNTIME ref: 00C25684
_memcmp.LIBVCRUNTIME ref: 00C2569E
_memcmp.LIBVCRUNTIME ref: 00C256B1
_memcmp.LIBVCRUNTIME ref: 00C256C9
_memcmp.LIBVCRUNTIME ref: 00C256E4

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 9e90e928290af8ded5788b21cc79b90b6cc7fd12e738d409cf043fa1ec75b4b2
Instruction ID: 5ee698d7b8c444a817d5040cf7d572368f3e155ca1f820d4545fb2c910cc629d
Opcode Fuzzy Hash: 9e90e928290af8ded5788b21cc79b90b6cc7fd12e738d409cf043fa1ec75b4b2
Instruction Fuzzy Hash: 8C210A75641A69B7D22899166D82FBB338CEF10785F540034FD045AF81F770FE1581A9

Function 00C44FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00C45007
NULL Pointer assignment, xrefs: 00C4502E, 00C45383

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 41c377d26c4cd0bf5009ef05099d9e9b0fbd123395cace151f1324adadcda502
Instruction ID: a8230c8019fbef59afc649c5bc502800c8dcb7e090e1372236b954d7578e6c7a
Opcode Fuzzy Hash: 41c377d26c4cd0bf5009ef05099d9e9b0fbd123395cace151f1324adadcda502
Instruction Fuzzy Hash: 58D1C375A0070AAFDF10CF98C881FAEB7B5BF48354F148069E925AB292E770DE45CB50

Function 00C01522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00C017FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00C015CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00C017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00C01651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00C017FB,?,00C017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00C016E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00C017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00C016FB

Part of subcall function 00BF3820: RtlAllocateHeap.NTDLL(00000000,?,00C91444,?,00BDFDF5,?,?,00BCA976,00000010,00C91440,00BC13FC,?,00BC13C6,?,00BC1129), ref: 00BF3852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00C017FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00C01777
__freea.LIBCMT ref: 00C017A2
__freea.LIBCMT ref: 00C017AE

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 870c1f359ebb99e0c3496261988d9445c96450e4836b6e07d8ae1ea9e11dc3a4
Instruction ID: d3a46eb1577eb33439d92989c3bc81b2e4d9776efe4c438b04f32bae6794ad9e
Opcode Fuzzy Hash: 870c1f359ebb99e0c3496261988d9445c96450e4836b6e07d8ae1ea9e11dc3a4
Instruction Fuzzy Hash: EB917F71E002169EDB208EA9CC81AEEFBF5AF49710F1C4659ED15EB1C1DB25DE44CB60

Function 00C44523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C44648
VariantInit.OLEAUT32(?), ref: 00C44749
VariantClear.OLEAUT32(?), ref: 00C44753
VariantClear.OLEAUT32(?), ref: 00C447B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00C4472C
Null Object assignment in FOR..IN loop, xrefs: 00C445D8, 00C44706, 00C447BE

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: f3a6f8d90df8a15538cc9d4da0b604766a026a4db68a939226c8813736782c52
Instruction ID: bc24be50a682158f5da72ebf455a66bfc76a518f2593afca5a9316963c46e6f9
Opcode Fuzzy Hash: f3a6f8d90df8a15538cc9d4da0b604766a026a4db68a939226c8813736782c52
Instruction Fuzzy Hash: DF917271A00215AFDF28CFA5C888FAEBBB8FF46715F208559F515AB280D7709945CFA0

Function 00C31187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00C3125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00C31284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00C312A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00C312D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00C3135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00C313C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00C31430

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 6c028529a676e81e89ce0ea6abd77e7685abf1c18409c45e0340a71c2f252335
Instruction ID: 8381e335835af18a6d54dc476651b015e845d0ed8ba4242f0df36aefedfe623a
Opcode Fuzzy Hash: 6c028529a676e81e89ce0ea6abd77e7685abf1c18409c45e0340a71c2f252335
Instruction Fuzzy Hash: 8691E076A20219AFDB00DFA8C884BBEB7F5FF44325F194029E911EB291D775A941CB90

Function 00BD948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 7138b30e9853de59d04a9df5488ed4141841353565425875d6181efe162da843
Instruction ID: 954cf54e53f1a4dc1946b5b3387325a0f43af6ec598b3f01c40c39383530e95a
Opcode Fuzzy Hash: 7138b30e9853de59d04a9df5488ed4141841353565425875d6181efe162da843
Instruction Fuzzy Hash: 7C912875D00219EFCB10CFA9CC84AEEBBB8FF49324F144596E515B7251D374AA82DB60

Function 00C43947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C4396B
CharUpperBuffW.USER32(?,?), ref: 00C43A7A
_wcslen.LIBCMT ref: 00C43A8A
VariantClear.OLEAUT32(?), ref: 00C43C1F

Part of subcall function 00C30CDF: VariantInit.OLEAUT32(00000000), ref: 00C30D1F
Part of subcall function 00C30CDF: VariantCopy.OLEAUT32(?,?), ref: 00C30D28
Part of subcall function 00C30CDF: VariantClear.OLEAUT32(?), ref: 00C30D34

Strings

Incorrect Parameter format, xrefs: 00C439A6, 00C43BA1
AUTOIT.ERROR, xrefs: 00C43A80, 00C43A85

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 7d620e0339f8b80c623ea10785ad67ad7b201671a13197e52b35041f6f8e8ec2
Instruction ID: c128aa0133832a3213f8429624dab048c448f43eb1e56207cce9a4b777dbcd60
Opcode Fuzzy Hash: 7d620e0339f8b80c623ea10785ad67ad7b201671a13197e52b35041f6f8e8ec2
Instruction Fuzzy Hash: AF9155746083459FCB04EF64C481A6AB7E5FF88314F14896EF89A9B351DB30EE45CB92

Function 00C44BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00C2000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C1FF41,80070057,?,?,?,00C2035E), ref: 00C2002B
Part of subcall function 00C2000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C1FF41,80070057,?,?), ref: 00C20046
Part of subcall function 00C2000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C1FF41,80070057,?,?), ref: 00C20054
Part of subcall function 00C2000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C1FF41,80070057,?), ref: 00C20064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00C44C51
_wcslen.LIBCMT ref: 00C44D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00C44DCF
CoTaskMemFree.OLE32(?), ref: 00C44DDA

Strings

NULL Pointer assignment, xrefs: 00C44E23, 00C44E52

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 08cd77843fdd30d1969066577f4ae6101100e59dec8bb1dbd8489ab09e1cde80
Instruction ID: dffbc8bb36d7b055b932d110df4d13719743f1e5500bdb0b64b47f0cd5312b2f
Opcode Fuzzy Hash: 08cd77843fdd30d1969066577f4ae6101100e59dec8bb1dbd8489ab09e1cde80
Instruction Fuzzy Hash: A2910571D0021DAFDF14DFA4D891EEEB7B9BF08314F20816AE915A7291EB709A45CF60

Function 00C520FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00C52183
GetMenuItemCount.USER32(00000000), ref: 00C521B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00C521DD
_wcslen.LIBCMT ref: 00C52213
GetMenuItemID.USER32(?,?), ref: 00C5224D
GetSubMenu.USER32(?,?), ref: 00C5225B

Part of subcall function 00C23A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C23A57
Part of subcall function 00C23A3D: GetCurrentThreadId.KERNEL32 ref: 00C23A5E
Part of subcall function 00C23A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00C225B3), ref: 00C23A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00C522E3

Part of subcall function 00C2E97B: Sleep.KERNELBASE ref: 00C2E9F3

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: d9225ac9a3298e71b5992bf5bac7d941e0523d1bcc6fb4c51c54ff6bad3dbc14
Instruction ID: 452b1d634fada7c0fa997fe5d209834a6b0578841d2a4242ec4be25da273b5ac
Opcode Fuzzy Hash: d9225ac9a3298e71b5992bf5bac7d941e0523d1bcc6fb4c51c54ff6bad3dbc14
Instruction Fuzzy Hash: AE71B379A00205AFCB10DF65C881AAEB7F1EF49321F148499E816FB351DB34EE858F94

Function 00C2AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00C2AEF9
GetKeyboardState.USER32(?), ref: 00C2AF0E
SetKeyboardState.USER32(?), ref: 00C2AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00C2AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00C2AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00C2AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00C2B020

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d53fd705a8a264ac2c9edf17001f33442924e9f83e8c967ee0cca0da89403536
Instruction ID: 140867e2e4cb324114a52c883542175754207d7cb80376d8bb390af3a98855ab
Opcode Fuzzy Hash: d53fd705a8a264ac2c9edf17001f33442924e9f83e8c967ee0cca0da89403536
Instruction Fuzzy Hash: 1151D0E06047E53EFB3782749945BBABFE95B06304F088489E1E995CC2C798AEC4D751

Function 00C2ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00C2AD19
GetKeyboardState.USER32(?), ref: 00C2AD2E
SetKeyboardState.USER32(?), ref: 00C2AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00C2ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00C2ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00C2AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00C2AE38

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 96222fceaa8b3ce56ef27ae189e12f09302771f86025b32eb43dbc6be6437835
Instruction ID: 3a3cd84291061cba8036db01ff78ba083afb206f4781a4e8388570031b475fea
Opcode Fuzzy Hash: 96222fceaa8b3ce56ef27ae189e12f09302771f86025b32eb43dbc6be6437835
Instruction Fuzzy Hash: D55106A15047F13EFB3783349C95B7ABFA85B46300F088488E1E556CC3D694EE99E752

Function 00BF542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00C03CD6,?,?,?,?,?,?,?,?,00BF5BA3,?,?,00C03CD6,?,?), ref: 00BF5470
__fassign.LIBCMT ref: 00BF54EB
__fassign.LIBCMT ref: 00BF5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00C03CD6,00000005,00000000,00000000), ref: 00BF552C
WriteFile.KERNEL32(?,00C03CD6,00000000,00BF5BA3,00000000,?,?,?,?,?,?,?,?,?,00BF5BA3,?), ref: 00BF554B
WriteFile.KERNEL32(?,?,00000001,00BF5BA3,00000000,?,?,?,?,?,?,?,?,?,00BF5BA3,?), ref: 00BF5584

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 6a453c17f65daa26525496e058359738e92fb9305a1018536367622105e88217
Instruction ID: 6747b6bc6c3917bba466bd5fa757ddb68d51a1afd27f05c534b05474bc0ba701
Opcode Fuzzy Hash: 6a453c17f65daa26525496e058359738e92fb9305a1018536367622105e88217
Instruction Fuzzy Hash: C751A071A00749AFDB20CFA8D885BEEBBF9EF19300F14419AE655F7291D7309A45CB60

Function 00C56B76 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00C56C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00C56C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00C56C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00C3AB79,00000000,00000000), ref: 00C56C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00C56CC7

Strings

@U=u, xrefs: 00C56C73

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID: @U=u
API String ID: 3688381893-2594219639
Opcode ID: 45a75b0bb1ec0279b23df3cf8f60558fd3091ac2fd701540bddcce9c6195b7b2
Instruction ID: 6048d19de6dbc5e295c252eac7905de6ff3f06f3f7d307d452d767e1436fec92
Opcode Fuzzy Hash: 45a75b0bb1ec0279b23df3cf8f60558fd3091ac2fd701540bddcce9c6195b7b2
Instruction Fuzzy Hash: 8441D73D604204AFD724CF28CC99FA97BA5EB09361F950268FCA5A72E0C771BEC5D644

Function 00BE2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BE2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00BE2D53
_ValidateLocalCookies.LIBCMT ref: 00BE2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00BE2E0C
_ValidateLocalCookies.LIBCMT ref: 00BE2E61

Strings

csm, xrefs: 00BE2DF6

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d7167bf5180ee40aa4ac9ce5ee71163b7ddaffec63fbe4f9c7ae7536101d5912
Instruction ID: 9fb859437c7884c002d3febf979b4b5b08ee2780b7945b1b97ce68662e8f5e2e
Opcode Fuzzy Hash: d7167bf5180ee40aa4ac9ce5ee71163b7ddaffec63fbe4f9c7ae7536101d5912
Instruction Fuzzy Hash: DD41A234E00289ABCF10DF6ACC85A9EBBF9FF44324F1481A5E9156B392D771DA11CB90

Function 00C410B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00C4307A
Part of subcall function 00C4304E: _wcslen.LIBCMT ref: 00C4309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00C41112
WSAGetLastError.WSOCK32 ref: 00C41121
WSAGetLastError.WSOCK32 ref: 00C411C9
closesocket.WSOCK32(00000000), ref: 00C411F9

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 3f146207560429c7e2debd96a1fe50e21c336d6f4a1c61a6a6bf064c03b161fb
Instruction ID: 4a6b6e62c6a0797311188130fac32615999ecd0bbb79438e35840f0f96874460
Opcode Fuzzy Hash: 3f146207560429c7e2debd96a1fe50e21c336d6f4a1c61a6a6bf064c03b161fb
Instruction Fuzzy Hash: 2841E535600204AFDB109F24C885BADBBE9FF45365F188059FD59AB292D770EE81CBE1

Function 00C2CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C2DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C2CF22,?), ref: 00C2DDFD

Part of subcall function 00C2DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C2CF22,?), ref: 00C2DE16

lstrcmpiW.KERNEL32(?,?), ref: 00C2CF45
MoveFileW.KERNEL32(?,?), ref: 00C2CF7F
_wcslen.LIBCMT ref: 00C2D005
_wcslen.LIBCMT ref: 00C2D01B
SHFileOperationW.SHELL32(?), ref: 00C2D061

Strings

\*.*, xrefs: 00C2CFF3

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: de865ab816da43e7f47754d4d851aad4d1844a9cb9c31d3f5397868e51cbcc99
Instruction ID: be3f0a3dc42818b586fe6331c1cffbb8155e181e78a6a403bf168dc70a6fb3c3
Opcode Fuzzy Hash: de865ab816da43e7f47754d4d851aad4d1844a9cb9c31d3f5397868e51cbcc99
Instruction Fuzzy Hash: F34155719452299EDF12EBA4DAC1ADEB7F8AF18380F1000E6E545EB542EB34A784CB50

Function 00C27726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C27769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C2778F
SysAllocString.OLEAUT32(00000000), ref: 00C27792
SysAllocString.OLEAUT32(?), ref: 00C277B0
SysFreeString.OLEAUT32(?), ref: 00C277B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00C277DE
SysAllocString.OLEAUT32(?), ref: 00C277EC

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: f25bef2ad7826ef8b2de561469bf72ccadc708b59dbca2a6eb2dd56373472c63
Instruction ID: bfa5ec595062060816673d569a57f2a66f17d057a0ebfc5a871796a2a3f5f672
Opcode Fuzzy Hash: f25bef2ad7826ef8b2de561469bf72ccadc708b59dbca2a6eb2dd56373472c63
Instruction Fuzzy Hash: EA21817A608329AFDB11DFA8DCC8EBF77ACEB097647048125B915DB250D670DD81C760

Function 00C21DE2 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

Part of subcall function 00C23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C23CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00C21E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00C21E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00C21EA9

Part of subcall function 00BC6B57: _wcslen.LIBCMT ref: 00BC6B6A

Strings

ComboBox, xrefs: 00C21DF0
ListBox, xrefs: 00C21E25
@U=u, xrefs: 00C21E66, 00C21E79, 00C21EA9

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: @U=u$ComboBox$ListBox
API String ID: 2081771294-2258501812
Opcode ID: 2b05505465e5f52233f0a5a567a4ce5459bdf9665c4921775a644037395d204d
Instruction ID: ec518d3808bae6e397371efb9f03232dc1bb795c35926e23dafa98a58e8b628a
Opcode Fuzzy Hash: 2b05505465e5f52233f0a5a567a4ce5459bdf9665c4921775a644037395d204d
Instruction Fuzzy Hash: A3212775A00204BFDB14AB64EC8ADFFB7B8DF55390B14412DFC25A75E1DB344E499620

Function 00C277FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C27842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C27868
SysAllocString.OLEAUT32(00000000), ref: 00C2786B
SysAllocString.OLEAUT32 ref: 00C2788C
SysFreeString.OLEAUT32 ref: 00C27895
StringFromGUID2.OLE32(?,?,00000028), ref: 00C278AF
SysAllocString.OLEAUT32(?), ref: 00C278BD

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 5eb13aebfa04aa17655ebd1a25ceff29f590b9839b9b1d7dc4a02fe31c5c36f3
Instruction ID: e5febb4149aa1b4f5c79dcd0d2f46478f960c72ece14bc28f91e1ee42231fbb0
Opcode Fuzzy Hash: 5eb13aebfa04aa17655ebd1a25ceff29f590b9839b9b1d7dc4a02fe31c5c36f3
Instruction Fuzzy Hash: 1A216535608314AFDB109FA9DCC8EBA77ECEB097607108125F915EB2E1E674DD81CB64

Function 00C55706 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00C55745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00C5579D
_wcslen.LIBCMT ref: 00C557AF
_wcslen.LIBCMT ref: 00C557BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C55816

Strings

@U=u, xrefs: 00C55745, 00C5579D, 00C55816

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID: @U=u
API String ID: 763830540-2594219639
Opcode ID: 3cfda6201d99656abcb659c30818c5a303462d059ed97ca5a1b2210c30700321
Instruction ID: 8d5bb4f8537619a6452e6f9143efb219f3aa43cdebf3781a9a0430135464c58e
Opcode Fuzzy Hash: 3cfda6201d99656abcb659c30818c5a303462d059ed97ca5a1b2210c30700321
Instruction Fuzzy Hash: 8A21A579904618DADB208FA1CC85AED77B8FF04322F108256FD29EA1C0D7708AC9CF58

Function 00C304D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00C304F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C3052E

Strings

nul, xrefs: 00C30567

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 4599a540e95e19f0c5ba894c87e5314939d8d43b0c7f17acc41f9e6691a63ee5
Instruction ID: fff0158bb58c2c15c1fbf089d0dae81b31990fcf9cf2f2054dbad88de80af438
Opcode Fuzzy Hash: 4599a540e95e19f0c5ba894c87e5314939d8d43b0c7f17acc41f9e6691a63ee5
Instruction Fuzzy Hash: 7E216B76510305AFDF209F69DC55B9A7BA4AF44725F304A19F8B1E62E0D7709A80CF24

Function 00C305A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00C305C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C30601

Strings

nul, xrefs: 00C30639

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: c0007734f3286f51055675d5129ccc0fd5003ed6f45c8604dadbc1581d2c9a63
Instruction ID: 68f5ef6d3d5da05516cacee6f874041fa7d1df74548dbebf187e1ddd2576c4d1
Opcode Fuzzy Hash: c0007734f3286f51055675d5129ccc0fd5003ed6f45c8604dadbc1581d2c9a63
Instruction Fuzzy Hash: 8D219F365103059FDB209F698C55B9A77B8AF85B21F300A19FCB1E72E4D77099A0CB10

Function 00C540AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00BC604C
Part of subcall function 00BC600E: GetStockObject.GDI32(00000011), ref: 00BC6060
Part of subcall function 00BC600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BC606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00C54112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00C5411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00C5412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00C54139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00C54145

Strings

Msctls_Progress32, xrefs: 00C540E3

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 7492813bd1e4fdd0e5dc3126b0b18e2b0644ef90a31a2baeb19b9126b088bbcd
Instruction ID: 4b12c980f91d334c1e8395f1ba89d1d7d665819eea509d6212b3077e8e6f6187
Opcode Fuzzy Hash: 7492813bd1e4fdd0e5dc3126b0b18e2b0644ef90a31a2baeb19b9126b088bbcd
Instruction Fuzzy Hash: 6C11B6B51402197EEF119F64CC85EEB7F9DEF08798F114111FA18A2090C672DC61DBA4

Function 00BFD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BFD7A3: _free.LIBCMT ref: 00BFD7CC

_free.LIBCMT ref: 00BFD82D

Part of subcall function 00BF29C8: HeapFree.KERNEL32(00000000,00000000,?,00BFD7D1,00000000,00000000,00000000,00000000,?,00BFD7F8,00000000,00000007,00000000,?,00BFDBF5,00000000), ref: 00BF29DE
Part of subcall function 00BF29C8: GetLastError.KERNEL32(00000000,?,00BFD7D1,00000000,00000000,00000000,00000000,?,00BFD7F8,00000000,00000007,00000000,?,00BFDBF5,00000000,00000000), ref: 00BF29F0

_free.LIBCMT ref: 00BFD838
_free.LIBCMT ref: 00BFD843
_free.LIBCMT ref: 00BFD897
_free.LIBCMT ref: 00BFD8A2
_free.LIBCMT ref: 00BFD8AD
_free.LIBCMT ref: 00BFD8B8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: fcc5bbf8f61fc8d25d2080858d960252212183b6b8f4db7fe50ae0e6fa78db1e
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: C5112171580B0CAAD521BFB0CC47FEBBBDDAF04700F404865B399AB5A2DA65B9094750

Function 00C2DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00C2DA74
LoadStringW.USER32(00000000), ref: 00C2DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00C2DA91
LoadStringW.USER32(00000000), ref: 00C2DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00C2DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00C2DAB9

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 65fb2217c6937ebc790c708eb6b0ed6c8182a16de5e8e0573e351257d172d892
Instruction ID: bd3d96b9b7c8e480a80661d8c6d028d82543f1c5810bb17baaf9147aa2d4e59f
Opcode Fuzzy Hash: 65fb2217c6937ebc790c708eb6b0ed6c8182a16de5e8e0573e351257d172d892
Instruction Fuzzy Hash: ED012CFA500318BFE710ABA09D89FEB326CE708706F4044A1B706E2041EA749E848B74

Function 00C3096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0192E270,0192E270), ref: 00C3097B
EnterCriticalSection.KERNEL32(0192E250,00000000), ref: 00C3098D
TerminateThread.KERNEL32(?,000001F6), ref: 00C3099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00C309A9
CloseHandle.KERNEL32(?), ref: 00C309B8
InterlockedExchange.KERNEL32(0192E270,000001F6), ref: 00C309C8
LeaveCriticalSection.KERNEL32(0192E250), ref: 00C309CF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: ef4c5caac2f338009db7b6b6295bae798b0813f0f79fbf5bfc199f588fa751d1
Instruction ID: 93c2da9b850a1a6dd4ff63ebefaf80845331b25c5ac224e9a4398de5d26b4eca
Opcode Fuzzy Hash: ef4c5caac2f338009db7b6b6295bae798b0813f0f79fbf5bfc199f588fa751d1
Instruction Fuzzy Hash: 5AF01932442B02AFD7415BA4EEC8BDEBA29FF01703F502025F202A08A1CB7495B5CF90

Function 00C41C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00C41DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00C41DE1
WSAGetLastError.WSOCK32 ref: 00C41DF2
htons.WSOCK32(?,?,?,?,?), ref: 00C41EDB
inet_ntoa.WSOCK32(?), ref: 00C41E8C

Part of subcall function 00C239E8: _strlen.LIBCMT ref: 00C239F2

Part of subcall function 00C43224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00C3EC0C), ref: 00C43240

_strlen.LIBCMT ref: 00C41F35

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: b3910693ecd76a454448e7ec5f3fe203ae5c59bcf42ec8ab9afc6eb33f462a1d
Instruction ID: fadd4a7e83fbf11732c7d1ddee62d1fcdf482a1c05b40dfeeba2c069f87b1b08
Opcode Fuzzy Hash: b3910693ecd76a454448e7ec5f3fe203ae5c59bcf42ec8ab9afc6eb33f462a1d
Instruction Fuzzy Hash: B7B1B2305043409FD314DF64C885F2A7BE5BF84318F58859CF8965B2A2DB31EE86CB91

Function 00BC5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00BC5D30
GetWindowRect.USER32(?,?), ref: 00BC5D71
ScreenToClient.USER32(?,?), ref: 00BC5D99
GetClientRect.USER32(?,?), ref: 00BC5ED7
GetWindowRect.USER32(?,?), ref: 00BC5EF8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 28ad24a00f8ec87d3b1121edd14f0ebc542c7e17a67f4b81d78ea88410064e18
Instruction ID: 0e17fe21effd9cf119b587db453c7b7dbce1807b927e88a91d21672998c957f4
Opcode Fuzzy Hash: 28ad24a00f8ec87d3b1121edd14f0ebc542c7e17a67f4b81d78ea88410064e18
Instruction Fuzzy Hash: 7FB15C74A0074ADBDB24CFA9C480BEEB7F1FF54310F14851AE9A9D7290DB34AA91DB50

Function 00BF01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00BF00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BF00D6
__allrem.LIBCMT ref: 00BF00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BF010B
__allrem.LIBCMT ref: 00BF0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BF0140

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: d9ecec568fa8557a1fa6a6936e29e799b26cfd007ce6682ba0daf552fcc96d7e
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 9D81E872601B0A9BE720AF79CC41B7BB3E9EF41724F24457AF651D7292EB70DA048790

Function 00BF61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00BE82D9,00BE82D9,?,?,?,00BF644F,00000001,00000001,8BE85006), ref: 00BF6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00BF644F,00000001,00000001,8BE85006,?,?,?), ref: 00BF62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00BF63D8
__freea.LIBCMT ref: 00BF63E5

Part of subcall function 00BF3820: RtlAllocateHeap.NTDLL(00000000,?,00C91444,?,00BDFDF5,?,?,00BCA976,00000010,00C91440,00BC13FC,?,00BC13C6,?,00BC1129), ref: 00BF3852

__freea.LIBCMT ref: 00BF63EE
__freea.LIBCMT ref: 00BF6413

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 5a93e095b4f7c05d0a32516b14a2cb148bdc9f9c30d3b011e99b94e16ea17081
Instruction ID: ffa352a0165432d63a9d69caa1b9b20adb1105cefd6e73ecc9a932edebc9fbc9
Opcode Fuzzy Hash: 5a93e095b4f7c05d0a32516b14a2cb148bdc9f9c30d3b011e99b94e16ea17081
Instruction Fuzzy Hash: 0D51D272A0021AABEB258F68CC81FBF77E9EB54750F1546A9FE05D7140EB34DC48C664

Function 00C4BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

Part of subcall function 00C4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C4B6AE,?,?), ref: 00C4C9B5
Part of subcall function 00C4C998: _wcslen.LIBCMT ref: 00C4C9F1
Part of subcall function 00C4C998: _wcslen.LIBCMT ref: 00C4CA68
Part of subcall function 00C4C998: _wcslen.LIBCMT ref: 00C4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C4BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C4BD25
RegCloseKey.ADVAPI32(00000000), ref: 00C4BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00C4BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00C4BDF3
RegCloseKey.ADVAPI32(?), ref: 00C4BDFF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 90cdbf0c29d39c1e1b487b99d7dec2cb5b368b7d3dd069a007db0d3164e217e5
Instruction ID: 7db8dce58272b08b4e53965fd1232a0d0f87c6898e8381f9e99a90bdfb782306
Opcode Fuzzy Hash: 90cdbf0c29d39c1e1b487b99d7dec2cb5b368b7d3dd069a007db0d3164e217e5
Instruction Fuzzy Hash: DC817C30608241AFD714DF24C895E2ABBF5FF84308F14899DF45A4B2A2DB31EE45CB92

Function 00C1F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00C1F7B9
SysAllocString.OLEAUT32(00000001), ref: 00C1F860
VariantCopy.OLEAUT32(00C1FA64,00000000), ref: 00C1F889
VariantClear.OLEAUT32(00C1FA64), ref: 00C1F8AD
VariantCopy.OLEAUT32(00C1FA64,00000000), ref: 00C1F8B1
VariantClear.OLEAUT32(?), ref: 00C1F8BB

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: db2a7479f553fec091ed8531c784c335dfd826f4cb9099c1b36b829242c470a4
Instruction ID: f1debd67bfee52626e3edb249917d959afe643f15a5f178d8255b6b3bd10fa66
Opcode Fuzzy Hash: db2a7479f553fec091ed8531c784c335dfd826f4cb9099c1b36b829242c470a4
Instruction Fuzzy Hash: A451B735500310BADF20BB65D895BB9B3E5EF46710F1444AFE806DF291DB708C81EB96

Function 00C3910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00BC7620: _wcslen.LIBCMT ref: 00BC7625

Part of subcall function 00BC6B57: _wcslen.LIBCMT ref: 00BC6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00C394E5
_wcslen.LIBCMT ref: 00C39506
_wcslen.LIBCMT ref: 00C3952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00C39585

Strings

X, xrefs: 00C39412

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 410d6c7c332f489703e393dd0aaf8c224a57745632575d3ffa91ea3b9d8a8021
Instruction ID: d5e82e824458b33979e220eeb1a3fffa8eac14562b60c0d175d5815880d53f89
Opcode Fuzzy Hash: 410d6c7c332f489703e393dd0aaf8c224a57745632575d3ffa91ea3b9d8a8021
Instruction Fuzzy Hash: 8AE18F715183409FD724EF24C881F6AB7E0FF85314F0489ADE8999B2A2DB71DE45CB92

Function 00BD920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00BD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BD9BB2

BeginPaint.USER32(?,?,?), ref: 00BD9241
GetWindowRect.USER32(?,?), ref: 00BD92A5
ScreenToClient.USER32(?,?), ref: 00BD92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00BD92D3
EndPaint.USER32(?,?,?,?,?), ref: 00BD9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00C171EA

Part of subcall function 00BD9339: BeginPath.GDI32(00000000), ref: 00BD9357

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 70f896296b9813111e6c71f16a8714075e1ec526e95acae2d53c5d94606f6d88
Instruction ID: 715f553764ebfbef30df9e29e3f187fd9b539701488aed249dd61932f25bbf74
Opcode Fuzzy Hash: 70f896296b9813111e6c71f16a8714075e1ec526e95acae2d53c5d94606f6d88
Instruction Fuzzy Hash: 2B41CD70104301AFD711DF24DCC9FAEBBF8EB46721F14066AF9A4972A1D7309985DB61

Function 00C307EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00C3080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00C30847
EnterCriticalSection.KERNEL32(?), ref: 00C30863
LeaveCriticalSection.KERNEL32(?), ref: 00C308DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00C308F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00C30921

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: ca0279e0dae1b916fa2cfcda9a56247c9fcac0430c1d062ba3dfb2bc2f938307
Instruction ID: 9478e002ef4524bb1f5a34325d0e6f4138d9df77bbc56c343cb6d9b00bcdf023
Opcode Fuzzy Hash: ca0279e0dae1b916fa2cfcda9a56247c9fcac0430c1d062ba3dfb2bc2f938307
Instruction Fuzzy Hash: AD415772900205AFDF14AF54DC85BAAB7B8FF04300F1440A5E905AA297DB30DEA5DBA4

Function 00C3581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00BC3A97,?,?,00BC2E7F,?,?,?,00000000), ref: 00BC3AC2

_wcslen.LIBCMT ref: 00C3587B
CoInitialize.OLE32(00000000), ref: 00C35995
CoCreateInstance.OLE32(00C5FCF8,00000000,00000001,00C5FB68,?), ref: 00C359AE
CoUninitialize.OLE32 ref: 00C359CC

Strings

.lnk, xrefs: 00C35876, 00C358C1, 00C35985

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 49afe0886141810c872f71333e6af479f9fc4e71a27d1c51e73488fdd8ba89db
Instruction ID: e5c99b7e1581876d4047dee2bc3242da32e1930242fcee72ca153b03d7052161
Opcode Fuzzy Hash: 49afe0886141810c872f71333e6af479f9fc4e71a27d1c51e73488fdd8ba89db
Instruction Fuzzy Hash: 13D16174618701DFC714DF24C484A2ABBE1EF89714F14889DF89A9B361DB31EE46CB92

Function 00C2175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C20FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C20FCA
Part of subcall function 00C20FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C20FD6
Part of subcall function 00C20FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C20FE5
Part of subcall function 00C20FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00C20FEC
Part of subcall function 00C20FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C21002

GetLengthSid.ADVAPI32(?,00000000,00C21335), ref: 00C217AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00C217BA
HeapAlloc.KERNEL32(00000000), ref: 00C217C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00C217DA
GetProcessHeap.KERNEL32(00000000,00000000,00C21335), ref: 00C217EE
HeapFree.KERNEL32(00000000), ref: 00C217F5

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 6f549182206640fc5031427ea5b017d0e8d670cc6953b504ecfa5d9a4990dc0b
Instruction ID: 99acd41ed7998a62a1e140c62afde10af23265de014c2e28be6f94745d2d9943
Opcode Fuzzy Hash: 6f549182206640fc5031427ea5b017d0e8d670cc6953b504ecfa5d9a4990dc0b
Instruction Fuzzy Hash: 8211BE35500715FFDB109FA4EC89BAF7BE9EB95756F184018F841A7211C735AA80CB60

Function 00C214CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00C214FF
OpenProcessToken.ADVAPI32(00000000), ref: 00C21506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00C21515
CloseHandle.KERNEL32(00000004), ref: 00C21520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C2154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00C21563

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 5ae894db724617db94c1e941ea401a9916e21805e35dc06ee6a9bd89acca2fd1
Instruction ID: 045edd4227d05d549a75da70e5d73d12f34c6eef28eb7ff613a18f21d0b76075
Opcode Fuzzy Hash: 5ae894db724617db94c1e941ea401a9916e21805e35dc06ee6a9bd89acca2fd1
Instruction Fuzzy Hash: 4A11597650030DAFDF118F98ED89BDE7BA9EF48745F088064FE15A2060C3758EA0DB60

Function 00BE3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BE3379,00BE2FE5), ref: 00BE3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BE339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BE33B7
SetLastError.KERNEL32(00000000,?,00BE3379,00BE2FE5), ref: 00BE3409

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7e962820405aa4a2e7062c13f5b6b00505c0c1021cc4c8c71a53f01924cabff1
Instruction ID: 663a1e85f71f65b7d595d023dbc0e01f494e7129bffcff58d6cff4c6569f8743
Opcode Fuzzy Hash: 7e962820405aa4a2e7062c13f5b6b00505c0c1021cc4c8c71a53f01924cabff1
Instruction Fuzzy Hash: 5801B53260D351AEA72627B67CCDB6A2AE4DB05BB573002ADF510932F1EF614D015668

Function 00BF2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BF5686,00C03CD6,?,00000000,?,00BF5B6A,?,?,?,?,?,00BEE6D1,?,00C88A48), ref: 00BF2D78
_free.LIBCMT ref: 00BF2DAB
_free.LIBCMT ref: 00BF2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00BEE6D1,?,00C88A48,00000010,00BC4F4A,?,?,00000000,00C03CD6), ref: 00BF2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00BEE6D1,?,00C88A48,00000010,00BC4F4A,?,?,00000000,00C03CD6), ref: 00BF2DEC
_abort.LIBCMT ref: 00BF2DF2

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: d6b0415571ceb64a9e45c0473f0ddec8b01fd9b156465f1ff980f3ab070e2293
Instruction ID: a66761a0c0379ea5cbb6bfe87d3096776b653fe44845fe21626541ffba8d1cbc
Opcode Fuzzy Hash: d6b0415571ceb64a9e45c0473f0ddec8b01fd9b156465f1ff980f3ab070e2293
Instruction Fuzzy Hash: D1F0A939545B0D2BC61227347C5AB7E25D5EFC1BA1B2445B5FB24932A2DF3489494160

Function 00C58A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00BD9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BD9693
Part of subcall function 00BD9639: SelectObject.GDI32(?,00000000), ref: 00BD96A2
Part of subcall function 00BD9639: BeginPath.GDI32(?), ref: 00BD96B9
Part of subcall function 00BD9639: SelectObject.GDI32(?,00000000), ref: 00BD96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00C58A4E
LineTo.GDI32(?,00000003,00000000), ref: 00C58A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00C58A70
LineTo.GDI32(?,00000000,00000003), ref: 00C58A80
EndPath.GDI32(?), ref: 00C58A90
StrokePath.GDI32(?), ref: 00C58AA0

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: af3d829a4165fd541c3e640cf758eb2181aed6a1cc16b40e8c1e6fb60d2d9f53
Instruction ID: 3fcb51287fb146a117d775ae9c89a780db6c4494cc4d4e3083a8d059ae157f0f
Opcode Fuzzy Hash: af3d829a4165fd541c3e640cf758eb2181aed6a1cc16b40e8c1e6fb60d2d9f53
Instruction Fuzzy Hash: D5110C76000209FFDB119F90DC88FAE7F6CEB04351F048012BE15A51A1C7719D95DB60

Function 00C251FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C25218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00C25229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C25230
ReleaseDC.USER32(00000000,00000000), ref: 00C25238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00C2524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00C25261

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 0ee8f25e1ef1972a2c811b91ae39936e318817278de49dc6255dffd976fad6a1
Instruction ID: 12582f721cc40245afaf59094fd3a06d67a12500ef77cad95ef731808532453d
Opcode Fuzzy Hash: 0ee8f25e1ef1972a2c811b91ae39936e318817278de49dc6255dffd976fad6a1
Instruction Fuzzy Hash: 28014F75A00718BFEB109BA59C89B5EBFB8EB48752F044065FA04A72C1DA709941CBA0

Function 00BC1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00BC1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00BC1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00BC1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00BC1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00BC1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BC1C22

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 476441c2c215814ef06fb00d6761e736a5930134c6cd70fb8fdeed48bb9c31d9
Instruction ID: 9922254fc7ece2051a836c78b782529e8932714fca6e4b86e4fb7517b971df3d
Opcode Fuzzy Hash: 476441c2c215814ef06fb00d6761e736a5930134c6cd70fb8fdeed48bb9c31d9
Instruction Fuzzy Hash: 75016CB09027597DE3008F5A8C85B56FFA8FF19354F00411BA15C47941C7F5A864CBE5

Function 00C2EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00C2EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00C2EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00C2EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C2EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C2EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C2EB75

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 9525f29122e6a6f6d9c411030d25cf8d18d8feeff327b5fcb5e486a9fb0480c3
Instruction ID: 0232a164bcd05e9a8f88d0db40b9d741be02f8be1d5b3a8be97a1be0e05dc237
Opcode Fuzzy Hash: 9525f29122e6a6f6d9c411030d25cf8d18d8feeff327b5fcb5e486a9fb0480c3
Instruction Fuzzy Hash: DAF0177A240758BFE6215B629C4EFEF3A7CEBCAB12F000158F611E10919AA05A8186B5

Function 00C21874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00C2187F
UnloadUserProfile.USERENV(?,?), ref: 00C2188B
CloseHandle.KERNEL32(?), ref: 00C21894
CloseHandle.KERNEL32(?), ref: 00C2189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00C218A5
HeapFree.KERNEL32(00000000), ref: 00C218AC

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 4b9bf3ec3a22dcf649e009a723f46e3ee19f3ca85c17d9623f2ae2d725fd36a1
Instruction ID: 6d28d2c3c9119cb3f09c26c7447ab8145a31ca18350ab521da1cecb6f76dfa42
Opcode Fuzzy Hash: 4b9bf3ec3a22dcf649e009a723f46e3ee19f3ca85c17d9623f2ae2d725fd36a1
Instruction Fuzzy Hash: 06E0C23A004705BFDA015BA1ED4CB4EBB69FB49B22B108220F226A1470CB32A4A0DB50

Function 00C2C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC7620: _wcslen.LIBCMT ref: 00BC7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C2C6EE
_wcslen.LIBCMT ref: 00C2C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C2C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00C2C7CA

Strings

0, xrefs: 00C2C6AF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: ede73b1df3214d0472edde45119104eacab0c130adc72dba9d280147c0a2df2e
Instruction ID: 12a0258a40bc8c76e98ef7742f30ade054af6264aa99963e0dc77d01f10cb7fd
Opcode Fuzzy Hash: ede73b1df3214d0472edde45119104eacab0c130adc72dba9d280147c0a2df2e
Instruction Fuzzy Hash: CA51DF716043219BD7149F28E8C5B6EB7E8AF49B10F040A2DF9A5E3990DB60DE44DB52

Function 00C4AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00C4AEA3

Part of subcall function 00BC7620: _wcslen.LIBCMT ref: 00BC7625

GetProcessId.KERNEL32(00000000), ref: 00C4AF38
CloseHandle.KERNEL32(00000000), ref: 00C4AF67

Strings

@, xrefs: 00C4AE72
<, xrefs: 00C4AE6B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 7472842029dfb8a00cafeb2999a6d1793f783a14308077e77e3c698a5d7e3907
Instruction ID: a31db5eebf73cc938e0f68891bc75997868eb563c5d628a290c8fc71942d6e3a
Opcode Fuzzy Hash: 7472842029dfb8a00cafeb2999a6d1793f783a14308077e77e3c698a5d7e3907
Instruction Fuzzy Hash: 3E713775A00619DFCB14DF94C494A9EBBF0FF08314F048499E866AB362CB74EE45CB91

Function 00C56278 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C562E2
ScreenToClient.USER32(?,?), ref: 00C56315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00C56382

Strings

@U=u, xrefs: 00C563DD

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID: @U=u
API String ID: 3880355969-2594219639
Opcode ID: 9ec2be069afba250983e9cfec7ae30c9f219a217229920d260fa5f78d3c710fd
Instruction ID: 358d7d88fd2907032a7cc419cbd5e136e0b66ca3752da07385d838b3f26b5fab
Opcode Fuzzy Hash: 9ec2be069afba250983e9cfec7ae30c9f219a217229920d260fa5f78d3c710fd
Instruction Fuzzy Hash: 14513C78A00209EFCF10DF54D881AAE7BB5EB45361F548169FD259B2A0D730EE85CB54

Function 00C22716 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C2B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C221D0,?,?,00000034,00000800,?,00000034), ref: 00C2B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00C22760

Part of subcall function 00C2B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C221FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00C2B3F8

Part of subcall function 00C2B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00C2B355
Part of subcall function 00C2B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00C22194,00000034,?,?,00001004,00000000,00000000), ref: 00C2B365
Part of subcall function 00C2B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00C22194,00000034,?,?,00001004,00000000,00000000), ref: 00C2B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C227CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C2281A

Strings

@, xrefs: 00C22832
@U=u, xrefs: 00C22760, 00C227CD, 00C2281A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @$@U=u
API String ID: 4150878124-826235744
Opcode ID: ce07ba8654a3301732aadc6a82609ad2f8ab109007eb1aceb77cfddcaf040667
Instruction ID: ee791f3d6de71eb0ad0f649eed25a02ce2302f422a121efbb4c56d8e3862064d
Opcode Fuzzy Hash: ce07ba8654a3301732aadc6a82609ad2f8ab109007eb1aceb77cfddcaf040667
Instruction Fuzzy Hash: D7412C76900228BEDB10DBA4D981BDEBBB8EB05700F004095FA55B7191DA706E45DB60

Function 00C2719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00C27206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00C2723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00C2724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00C272CF

Strings

DllGetClassObject, xrefs: 00C27242

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 2401cdda0d6b133ed9749c56556777a0b3a9f9eb24cf8252d77337c65847cc5a
Instruction ID: e6deb710c381852d4d37728b06ceb29e62e811ed7e8520b561feff940c09d388
Opcode Fuzzy Hash: 2401cdda0d6b133ed9749c56556777a0b3a9f9eb24cf8252d77337c65847cc5a
Instruction Fuzzy Hash: 544168B5A04214EFDB15CF54D8C4B9A7BA9EF44314F1582ADFD059F20AD7B0DA84CBA0

Function 00C552C1 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00C55352
GetWindowLongW.USER32(?,000000F0), ref: 00C55375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C55382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C553A8

Strings

@U=u, xrefs: 00C55352

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID: @U=u
API String ID: 3340791633-2594219639
Opcode ID: 6c10def8d53858e09f48c73e75fe8380758ed3733b49ea40306ca52d6ae1b76f
Instruction ID: 2b7f82b13e7b7d6fb60698c651892cee3badab1587daf5dcc037885eb8ac4933
Opcode Fuzzy Hash: 6c10def8d53858e09f48c73e75fe8380758ed3733b49ea40306ca52d6ae1b76f
Instruction Fuzzy Hash: 7731B43CA55A08EFEB309F14CC66BE87765AB04392F584112FE29961F1C7B09BC89749

Function 00C53D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C53E35
IsMenu.USER32(?), ref: 00C53E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C53E92
DrawMenuBar.USER32 ref: 00C53EA5

Strings

0, xrefs: 00C53D89

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 1786a7200c971a1d843b4af055dcea2d0be77133272fa779d0992b87feec7270
Instruction ID: b4221f09f6eb26e8384c17a882e1ff0b3648bea32e8713651f9adcd0a17ed1b1
Opcode Fuzzy Hash: 1786a7200c971a1d843b4af055dcea2d0be77133272fa779d0992b87feec7270
Instruction Fuzzy Hash: A5416C79A00249AFDB10DF50D889E9AB7F5FF45395F044019ED15A7250D770AE88CF64

Function 00C4C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C4C9F1
_wcslen.LIBCMT ref: 00C4CA68
_wcslen.LIBCMT ref: 00C4CA9E
_wcslen.LIBCMT ref: 00C4CAF9
_wcslen.LIBCMT ref: 00C4CB2F
_wcslen.LIBCMT ref: 00C4CB7F

Strings

HKLM, xrefs: 00C4CA98, 00C4CA9D
HKEY_LOCAL_MACHINE, xrefs: 00C4CA62, 00C4CA67

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 5f99fcae6f5752efaca73f3b9c5cad2bf303952037cbe7f9b62d5ac0a82284a2
Instruction ID: 2c2a52cd00b8c5521395d46b4be49202d2a695350c6e4e1a5731505128ae97c7
Opcode Fuzzy Hash: 5f99fcae6f5752efaca73f3b9c5cad2bf303952037cbe7f9b62d5ac0a82284a2
Instruction Fuzzy Hash: 02310973A0216A4BCB60EF2DC8C05BE33917B61754B154069E8616B365FB71CF44E3A0

Function 00C52F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00C52F8D
LoadLibraryW.KERNEL32(?), ref: 00C52F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00C52FA9
DestroyWindow.USER32(?), ref: 00C52FB1

Strings

SysAnimate32, xrefs: 00C52F68

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 7302fcb3d937a73ff22766feff26494f881087102b1d9982bd8af1b7a97f90c5
Instruction ID: a5c010e14de9a58e1993943b507ad52cf378c9b49a13d04d8f57607c3bcd6731
Opcode Fuzzy Hash: 7302fcb3d937a73ff22766feff26494f881087102b1d9982bd8af1b7a97f90c5
Instruction Fuzzy Hash: 2C218B79204215AFEB104FA4EC80FBB37F9EB5A366F100318FD60A6190D671DD959B68

Function 00C55660 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00C556BB
_wcslen.LIBCMT ref: 00C556CD
_wcslen.LIBCMT ref: 00C556D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C55816

Strings

@U=u, xrefs: 00C556BB, 00C55816

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID: @U=u
API String ID: 455545452-2594219639
Opcode ID: 7bf67aa12aa7611990acaff02c71e9200e2d8374bc53b2ca4a989152f79f648f
Instruction ID: 952513b6996f94451f701a3138d67692370fd8627bda06e6188b1b16d9893634
Opcode Fuzzy Hash: 7bf67aa12aa7611990acaff02c71e9200e2d8374bc53b2ca4a989152f79f648f
Instruction Fuzzy Hash: 9811D6796006049ADF209F62CC95AEE77BCEF10762B104066FD15D6181EB70CAC8CB6C

Function 00BC600E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00BC604C
GetStockObject.GDI32(00000011), ref: 00BC6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00BC606A

Strings

@U=u, xrefs: 00BC606A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID: @U=u
API String ID: 3970641297-2594219639
Opcode ID: 97f5b073c7fb24dd25f0b22b301676b60e7a218a3b6b6a189502291b66c253c4
Instruction ID: 164f8d5fbcc9839648efcb1e40dd75ed189dc58af54d864fad647e96b45e6d04
Opcode Fuzzy Hash: 97f5b073c7fb24dd25f0b22b301676b60e7a218a3b6b6a189502291b66c253c4
Instruction Fuzzy Hash: C7116172501609BFEF164F949C84FEE7BA9EF0C395F050155FA1462110DB329CA0DBA0

Function 00BE4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00BE4D1E,00BF28E9,?,00BE4CBE,00BF28E9,00C888B8,0000000C,00BE4E15,00BF28E9,00000002), ref: 00BE4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BE4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00BE4D1E,00BF28E9,?,00BE4CBE,00BF28E9,00C888B8,0000000C,00BE4E15,00BF28E9,00000002,00000000), ref: 00BE4DC3

Strings

mscoree.dll, xrefs: 00BE4D86
CorExitProcess, xrefs: 00BE4D98

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: dd338289d5f1bae36de7dc4203539c03ee69bbc52a349e99457374f9c6273bbe
Instruction ID: 947614b90e80f19fe4f76d5703d1323e8057b3e816865e044484c790f9d71783
Opcode Fuzzy Hash: dd338289d5f1bae36de7dc4203539c03ee69bbc52a349e99457374f9c6273bbe
Instruction Fuzzy Hash: B2F03C35A40308AFDB119F91DC89BAEBBE5EB44752F0040A4A805B22A0CB705D80CB90

Function 00C1D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00C1D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00C1D3BF
FreeLibrary.KERNEL32(00000000), ref: 00C1D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00C1D3B9
X64, xrefs: 00C1D2A8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 9fd3dc0b75aae1e2a529cf64e4598608fe91b0e5848cd5c7e66e999f6903f790
Instruction ID: dc221ec65ca9c9efbded5e479c18f7dff65dfa93de3e98707550f11353072384
Opcode Fuzzy Hash: 9fd3dc0b75aae1e2a529cf64e4598608fe91b0e5848cd5c7e66e999f6903f790
Instruction Fuzzy Hash: E1F0A779405B329FD73557118CD8AEE7324AF13702B954196F823F2125EB70CEC4A696

Function 00BC4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00BC4EDD,?,00C91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BC4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00BC4EAE
FreeLibrary.KERNEL32(00000000,?,?,00BC4EDD,?,00C91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BC4EC0

Strings

kernel32.dll, xrefs: 00BC4E94
Wow64DisableWow64FsRedirection, xrefs: 00BC4EA8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: a8ac852d01cb6e0876668fa5dee954035ba1621075978acebd5647f86c2b92d1
Instruction ID: 74b8814ae4d08f534fddde04a5b1a65ebc1e553a42e9f6f7690532fe6b8dcd30
Opcode Fuzzy Hash: a8ac852d01cb6e0876668fa5dee954035ba1621075978acebd5647f86c2b92d1
Instruction Fuzzy Hash: 55E0CD3AA01B235FD23117256C68F6F7694EF81F637060169FC00F2100DF60CE4181E4

Function 00BC4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00C03CDE,?,00C91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BC4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00BC4E74
FreeLibrary.KERNEL32(00000000,?,?,00C03CDE,?,00C91418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00BC4E87

Strings

kernel32.dll, xrefs: 00BC4E5B
Wow64RevertWow64FsRedirection, xrefs: 00BC4E6E

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: ba01ce34935b1590a04f5a847182d81fece4bba167a35d69f36136d72204bd09
Instruction ID: 3cbe53427df11b36b0cf0054858b3bebc38abac2c2d4631a76b55cdb16ef48c2
Opcode Fuzzy Hash: ba01ce34935b1590a04f5a847182d81fece4bba167a35d69f36136d72204bd09
Instruction Fuzzy Hash: F9D0123A502B225B56261B297C68F8F6A58EF85F563060569BD05B2115CF60CE42C5E4

Function 00C32947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C32C05
DeleteFileW.KERNEL32(?), ref: 00C32C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00C32C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C32CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C32CC0

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 90bdf23f78722648029fb1bb3369c11d7d416327260a870816d75205380baf02
Instruction ID: 988ec24f238db8907abceeef50db448b9f9095d816bc7f49f846203ebf5d85c7
Opcode Fuzzy Hash: 90bdf23f78722648029fb1bb3369c11d7d416327260a870816d75205380baf02
Instruction Fuzzy Hash: 24B15F71E10119ABDF21DFA5CC85EDEB7BDEF48350F1040A6F609E6151EB30AA448FA1

Function 00C4A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00C4A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00C4A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00C4A468
CloseHandle.KERNEL32(?), ref: 00C4A63D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 99155eaeb1ecf9229d2c24a7db068ed3c5f291d65d1ce85312cb2718fb89e895
Instruction ID: 9b1aa3ca76378ce712314f67c1afb1eb622511828354c7dddd3471d28d2781db
Opcode Fuzzy Hash: 99155eaeb1ecf9229d2c24a7db068ed3c5f291d65d1ce85312cb2718fb89e895
Instruction Fuzzy Hash: 2FA1B0716447009FD720DF24C886F2AB7E5AF94714F14885DF56A9B3D2D770ED418B82

Function 00BFBB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00C63700), ref: 00BFBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00C9121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00BFBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00C91270,000000FF,?,0000003F,00000000,?), ref: 00BFBC36
_free.LIBCMT ref: 00BFBB7F

Part of subcall function 00BF29C8: HeapFree.KERNEL32(00000000,00000000,?,00BFD7D1,00000000,00000000,00000000,00000000,?,00BFD7F8,00000000,00000007,00000000,?,00BFDBF5,00000000), ref: 00BF29DE
Part of subcall function 00BF29C8: GetLastError.KERNEL32(00000000,?,00BFD7D1,00000000,00000000,00000000,00000000,?,00BFD7F8,00000000,00000007,00000000,?,00BFDBF5,00000000,00000000), ref: 00BF29F0

_free.LIBCMT ref: 00BFBD4B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: dbbe8f8e5662fd95f7fbf943906d3821c051d33800616624fce500a5e24c5998
Instruction ID: 09d56d3406f5a4c82fa9793cae1680078eb64cff3dcd586f1d080412abdb1378
Opcode Fuzzy Hash: dbbe8f8e5662fd95f7fbf943906d3821c051d33800616624fce500a5e24c5998
Instruction Fuzzy Hash: 5951C67190020DEFCB14EF65DC85EBEB7F8EB40360B1442EAE654D71A1EB709E498B50

Function 00C2E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C2DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C2CF22,?), ref: 00C2DDFD

Part of subcall function 00C2DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C2CF22,?), ref: 00C2DE16

Part of subcall function 00C2E199: GetFileAttributesW.KERNEL32(?,00C2CF95), ref: 00C2E19A

lstrcmpiW.KERNEL32(?,?), ref: 00C2E473
MoveFileW.KERNEL32(?,?), ref: 00C2E4AC
_wcslen.LIBCMT ref: 00C2E5EB
_wcslen.LIBCMT ref: 00C2E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00C2E650

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 5b4ba8a79e07b574057134d11d16b3ae3b95343bf73bbda6973b5c539e63834b
Instruction ID: 4245c0c82e36d13602ccb58a78098a5b5f145da19cc5ffd3d27ec25cff7f67fa
Opcode Fuzzy Hash: 5b4ba8a79e07b574057134d11d16b3ae3b95343bf73bbda6973b5c539e63834b
Instruction Fuzzy Hash: F95164B24083959BD724EB90DC81ADFB3DCAF84340F00492EF599D3551EF74A688C766

Function 00C4B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

Part of subcall function 00C4C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C4B6AE,?,?), ref: 00C4C9B5
Part of subcall function 00C4C998: _wcslen.LIBCMT ref: 00C4C9F1
Part of subcall function 00C4C998: _wcslen.LIBCMT ref: 00C4CA68
Part of subcall function 00C4C998: _wcslen.LIBCMT ref: 00C4CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C4BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C4BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00C4BB63
RegCloseKey.ADVAPI32(?,?), ref: 00C4BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00C4BBB3

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 3327578bd8857c90bfa1d55931ce06f3b40a7c1bd10280ef24dcd903ee12490a
Instruction ID: a6fb2a2a2a8c23992f357c31b0d0b8cea1408dae30c296f30c050e92ade0312c
Opcode Fuzzy Hash: 3327578bd8857c90bfa1d55931ce06f3b40a7c1bd10280ef24dcd903ee12490a
Instruction Fuzzy Hash: D0617131208241AFD714DF24C895F2ABBE5FF84348F54899CF4998B2A2DB31ED45DB92

Function 00C28BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C28BCD
VariantClear.OLEAUT32 ref: 00C28C3E
VariantClear.OLEAUT32 ref: 00C28C9D
VariantClear.OLEAUT32(?), ref: 00C28D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00C28D3B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: b7c00d4ff6835579d03ad2fff5a98594c696b9e60fc9c62816a48c127b648a2f
Instruction ID: 4fd99db78a58afdc81a3608429ac50286b257299e361c4a21c87a7c3cb0caeaa
Opcode Fuzzy Hash: b7c00d4ff6835579d03ad2fff5a98594c696b9e60fc9c62816a48c127b648a2f
Instruction Fuzzy Hash: 53516BB5A0121AEFDB10CF58D884AAAB7F4FF89310F158559E915DB350E730E915CF90

Function 00C38AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00C38BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00C38BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00C38C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00C38C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00C38C5F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 73f54881404b9d7a772230b26a760c20ea4c94f7c74d5fdab21b632873e97628
Instruction ID: c9cb0eec6aca723b420c1eb202301509386f338c5dc1d02cdde01b9ff803db68
Opcode Fuzzy Hash: 73f54881404b9d7a772230b26a760c20ea4c94f7c74d5fdab21b632873e97628
Instruction Fuzzy Hash: D1512835A102159FCB05DF64C881E6DBBF5FF48314F088499E849AB362DB31ED55DB90

Function 00C48EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00C48F40
GetProcAddress.KERNEL32(00000000,?), ref: 00C48FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00C48FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00C49032
FreeLibrary.KERNEL32(00000000), ref: 00C49052

Part of subcall function 00BDF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00C31043,?,75B8E610), ref: 00BDF6E6
Part of subcall function 00BDF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00C1FA64,00000000,00000000,?,?,00C31043,?,75B8E610,?,00C1FA64), ref: 00BDF70D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 36daf69adc3b2aab98b59d66053db2eeaa2c92e665c41a1dbabe625825aee4c9
Instruction ID: 357154058c166f5644d5690524691cb23a603753dc246c5826e6c2b8ea5d0477
Opcode Fuzzy Hash: 36daf69adc3b2aab98b59d66053db2eeaa2c92e665c41a1dbabe625825aee4c9
Instruction Fuzzy Hash: C6513B39604215DFD711DF68C494DAEBBF1FF59314B048099E816AB362DB31EE89CB90

Function 00BF2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF20C3
_free.LIBCMT ref: 00BF20E3

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4ba99391621eb2c16667e1f82dc1c8e41247cbd24e745e558d7f65ea7d83a1b0
Instruction ID: 49d4e7ca98b13c52bc4635f713755031acb2d09bf6357962bf1764428edcdde0
Opcode Fuzzy Hash: 4ba99391621eb2c16667e1f82dc1c8e41247cbd24e745e558d7f65ea7d83a1b0
Instruction Fuzzy Hash: 2741C332A002089FCB24DF78C881A6DB7F5EF89314F1545E9E616EB391DB31AE05CB90

Function 00BD912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BD9141
ScreenToClient.USER32(00000000,?), ref: 00BD915E
GetAsyncKeyState.USER32(00000001), ref: 00BD9183
GetAsyncKeyState.USER32(00000002), ref: 00BD919D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 3985f68b2874895a78096e9f2030121127d3d8c0ea20bd44bab93ef2d9c52489
Instruction ID: 4736994c7edf3bc0d33686935613c11c1ee1c32e3a0643bfe754029206dbe35f
Opcode Fuzzy Hash: 3985f68b2874895a78096e9f2030121127d3d8c0ea20bd44bab93ef2d9c52489
Instruction Fuzzy Hash: E641607590860AFBDF199F64C844BEEF7B4FB06320F204356E429A3290D7346994EB51

Function 00C33874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00C338CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00C33922
TranslateMessage.USER32(?), ref: 00C3394B
DispatchMessageW.USER32(?), ref: 00C33955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C33966

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 8e2e2c3e91d2258874841832f6a9b97d6c6b5f38934e30a790b218e80d575ff8
Instruction ID: 3a4e15229c02d051fdd8de5cc20fabd24d86cc36ab4616c2ed24c4a54c14410c
Opcode Fuzzy Hash: 8e2e2c3e91d2258874841832f6a9b97d6c6b5f38934e30a790b218e80d575ff8
Instruction Fuzzy Hash: C431D7705243C2DEEB35CB35D84DBBA37A8EB05350F08056AE872D61E0E3B49785DB11

Function 00C3CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00C3CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00C3CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00C3C21E,00000000), ref: 00C3CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00C3C21E,00000000), ref: 00C3CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00C3C21E,00000000), ref: 00C3CFF2

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 707ddbfb3af027466d4f42fcae7a8d9ffb044b441ef7c24bf95f0b801849d7e6
Instruction ID: 8db134f026dff40e28a71a9464080ebf6fb7d9855c2ccc29ae6ff185ed989215
Opcode Fuzzy Hash: 707ddbfb3af027466d4f42fcae7a8d9ffb044b441ef7c24bf95f0b801849d7e6
Instruction Fuzzy Hash: 9C315871614305AFDB20DFA6C8C4AAEBBF9EB18351F10442EE516E2200EB30AE419B60

Function 00C21901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C21915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00C219C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00C219C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00C219DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00C219E2

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: c8596e49b7f0adf25d37405cc3eacfec84ce032411387d30de8bcfbf0584e9c7
Instruction ID: a36d08afef191b1ca85284ebf12ce751d08f5ac8bab921f95f70f03422e49b57
Opcode Fuzzy Hash: c8596e49b7f0adf25d37405cc3eacfec84ce032411387d30de8bcfbf0584e9c7
Instruction Fuzzy Hash: 2F31BF75A00229EFCB00DFA8DD99BDE7BB5EB14315F144229FD21A72D1C7709A94CB90

Function 00C40930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00C40951
GetForegroundWindow.USER32 ref: 00C40968
GetDC.USER32(00000000), ref: 00C409A4
GetPixel.GDI32(00000000,?,00000003), ref: 00C409B0
ReleaseDC.USER32(00000000,00000003), ref: 00C409E8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 9936cf8883cca3890f88bfd208e317de5322b545750074ad0619bcd70a0146fe
Instruction ID: db35155f634cc2df3c797714e40189ea314203f5356d0fd826979f6c57b24bf8
Opcode Fuzzy Hash: 9936cf8883cca3890f88bfd208e317de5322b545750074ad0619bcd70a0146fe
Instruction Fuzzy Hash: B9216D39600214AFD704EF65C889FAEBBE9EF58701F14846CF85AA7762CB30AD44DB50

Function 00BFCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00BFCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BFCDE9

Part of subcall function 00BF3820: RtlAllocateHeap.NTDLL(00000000,?,00C91444,?,00BDFDF5,?,?,00BCA976,00000010,00C91440,00BC13FC,?,00BC13C6,?,00BC1129), ref: 00BF3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00BFCE0F
_free.LIBCMT ref: 00BFCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BFCE31

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: d7e78c716b3b96feaacb82d7b6a389ed7027102463a2bb7c933abdd0a40c14d1
Instruction ID: 0ecb2017b37194f9e219864ec122a9364b84cba7e48d3cd21b996ac9f765b853
Opcode Fuzzy Hash: d7e78c716b3b96feaacb82d7b6a389ed7027102463a2bb7c933abdd0a40c14d1
Instruction Fuzzy Hash: 31012472A0131D3F23211ABA6DC8EBF6DECDEC6BA131401A9FB00D3200EA609D4581F0

Function 00BD9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BD9693
SelectObject.GDI32(?,00000000), ref: 00BD96A2
BeginPath.GDI32(?), ref: 00BD96B9
SelectObject.GDI32(?,00000000), ref: 00BD96E2

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b03748f0e3f3624bf4f463bbeb0db40e307623ebf5ea7db45fca08fcca401273
Instruction ID: f80ea4a3958b6ee0411e1280d5c5e8e883510a27abd82c986cc226ae7b232aa8
Opcode Fuzzy Hash: b03748f0e3f3624bf4f463bbeb0db40e307623ebf5ea7db45fca08fcca401273
Instruction Fuzzy Hash: 12218034802306EFDB119F64EC4A7AEBBB8FB50756F154257F820A62B0E3709991CB90

Function 00C25711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00C25726
_memcmp.LIBVCRUNTIME ref: 00C25744
_memcmp.LIBVCRUNTIME ref: 00C25757
_memcmp.LIBVCRUNTIME ref: 00C2576F
_memcmp.LIBVCRUNTIME ref: 00C25787

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 55ef6665b5b26c13980a94857d76f4ab50510686ae597b6c270c7840eb6d7009
Instruction ID: a55dd39b8c1c4d27e57bba45267f5582370090735a9436a263f69929c602cfa2
Opcode Fuzzy Hash: 55ef6665b5b26c13980a94857d76f4ab50510686ae597b6c270c7840eb6d7009
Instruction Fuzzy Hash: 4401F5B5691669FBD21C9516AE82FBB738CDB20BA5F100034FD049AA41F730FE5582A8

Function 00BF2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00BEF2DE,00BF3863,00C91444,?,00BDFDF5,?,?,00BCA976,00000010,00C91440,00BC13FC,?,00BC13C6), ref: 00BF2DFD
_free.LIBCMT ref: 00BF2E32
_free.LIBCMT ref: 00BF2E59
SetLastError.KERNEL32(00000000,00BC1129), ref: 00BF2E66
SetLastError.KERNEL32(00000000,00BC1129), ref: 00BF2E6F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 152b4c34ee2f14c1388ee102a29627ddd343a9dcf4a11adee9a330b5314a3331
Instruction ID: ef244a9156e24453066efe6d2ec4d7754cfc2a1210cbf8166a755d87c577f4ab
Opcode Fuzzy Hash: 152b4c34ee2f14c1388ee102a29627ddd343a9dcf4a11adee9a330b5314a3331
Instruction Fuzzy Hash: 0C01F43624570C6BC6122774ACC9F7F2AD9EBC17A1B3040A9FB21A32A2EB708C1D4120

Function 00C2000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C1FF41,80070057,?,?,?,00C2035E), ref: 00C2002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C1FF41,80070057,?,?), ref: 00C20046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C1FF41,80070057,?,?), ref: 00C20054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C1FF41,80070057,?), ref: 00C20064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00C1FF41,80070057,?,?), ref: 00C20070

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: df0728fcf3d3d1f0c16f7f3e6993c7654d24decb1c1ee838d4fa05631ffc6b94
Instruction ID: 7db4fea4ada9672e95f5c47ee7ffe74b441c94e6793cf081fc7062153d36a5cb
Opcode Fuzzy Hash: df0728fcf3d3d1f0c16f7f3e6993c7654d24decb1c1ee838d4fa05631ffc6b94
Instruction Fuzzy Hash: 88018476600314BFEB104F65EC84BAE7BADEB44752F244115F905E2621D775DD808760

Function 00C210F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C21114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00C20B9B,?,?,?), ref: 00C21120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00C20B9B,?,?,?), ref: 00C2112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00C20B9B,?,?,?), ref: 00C21136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C2114D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: d2df13d4d10437c277f3a4f817073e70b4bd42e99ef27a30f2fcabc171c5df49
Instruction ID: a07edaab47a98075f641bb16402753fcecce080a4b36c3d923aada445c27f147
Opcode Fuzzy Hash: d2df13d4d10437c277f3a4f817073e70b4bd42e99ef27a30f2fcabc171c5df49
Instruction Fuzzy Hash: FE014B79100315BFDB114F64EC89B6E3F6EEF892A1B140414FA41E2260DA31DD50CA60

Function 00C20FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C20FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C20FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C20FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00C20FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C21002

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 1165899390b816b8da3ca80bfc382ee2cde1bbeea420f2fdcd366e6c3bca0159
Instruction ID: 49e38277d80e8d8ccd48b9f5d6fcc3b8d625f3df19b158a4cb3a312fb1526c7b
Opcode Fuzzy Hash: 1165899390b816b8da3ca80bfc382ee2cde1bbeea420f2fdcd366e6c3bca0159
Instruction Fuzzy Hash: 60F04939200315AFDB214FA5AC89F5F3BADEF89762F144414FA46E6291CA70DC908A60

Function 00C21014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00C2102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00C21036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C21045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00C2104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C21062

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: b46e7df6a9c21b3e3099b3c778d0ec6c0b30b56dd9dfdf30f4c78e6eab09667c
Instruction ID: d0e9fb8dd1c4704d721443c3b4bb1108a74f7f4f473375801d8c8963e87dcce5
Opcode Fuzzy Hash: b46e7df6a9c21b3e3099b3c778d0ec6c0b30b56dd9dfdf30f4c78e6eab09667c
Instruction Fuzzy Hash: C8F04939200355AFDB215FA5EC89F5F3BADEF89762F140414FA46E6290CA70D9908A60

Function 00C3030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00C3017D,?,00C332FC,?,00000001,00C02592,?), ref: 00C30324
CloseHandle.KERNEL32(?,?,?,?,00C3017D,?,00C332FC,?,00000001,00C02592,?), ref: 00C30331
CloseHandle.KERNEL32(?,?,?,?,00C3017D,?,00C332FC,?,00000001,00C02592,?), ref: 00C3033E
CloseHandle.KERNEL32(?,?,?,?,00C3017D,?,00C332FC,?,00000001,00C02592,?), ref: 00C3034B
CloseHandle.KERNEL32(?,?,?,?,00C3017D,?,00C332FC,?,00000001,00C02592,?), ref: 00C30358
CloseHandle.KERNEL32(?,?,?,?,00C3017D,?,00C332FC,?,00000001,00C02592,?), ref: 00C30365

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 21b28c59edeb9cd715ab52e25c62cba65a89e06ca1086a4e0225a8b29a7aed5e
Instruction ID: 85163131553f1f85efe1da55f5fc05e1ad9265eea4d8326418fc075806b7107d
Opcode Fuzzy Hash: 21b28c59edeb9cd715ab52e25c62cba65a89e06ca1086a4e0225a8b29a7aed5e
Instruction Fuzzy Hash: 8501A272810B159FC7309F66D890416F7F9FF503153258A3FD1A652931C371AA94CF80

Function 00BFD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BFD752

Part of subcall function 00BF29C8: HeapFree.KERNEL32(00000000,00000000,?,00BFD7D1,00000000,00000000,00000000,00000000,?,00BFD7F8,00000000,00000007,00000000,?,00BFDBF5,00000000), ref: 00BF29DE
Part of subcall function 00BF29C8: GetLastError.KERNEL32(00000000,?,00BFD7D1,00000000,00000000,00000000,00000000,?,00BFD7F8,00000000,00000007,00000000,?,00BFDBF5,00000000,00000000), ref: 00BF29F0

_free.LIBCMT ref: 00BFD764
_free.LIBCMT ref: 00BFD776
_free.LIBCMT ref: 00BFD788
_free.LIBCMT ref: 00BFD79A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5b0990bb60b40fa6248e2dd0816cd23d5112f504ce810718d6565e88b6d95f6e
Instruction ID: 2b3c8d96bf3388d09539e86532ecbc56a522d1a53687596254c60887d2c029bb
Opcode Fuzzy Hash: 5b0990bb60b40fa6248e2dd0816cd23d5112f504ce810718d6565e88b6d95f6e
Instruction Fuzzy Hash: 8EF0FF3258420DABC621FB64F9C5E2A77DEFB447107A44899F258EB651CB70FC848774

Function 00C25C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00C25C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00C25C6F
MessageBeep.USER32(00000000), ref: 00C25C87
KillTimer.USER32(?,0000040A), ref: 00C25CA3
EndDialog.USER32(?,00000001), ref: 00C25CBD

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 6f030da9b2da43ac9bf4359c5b2a3c614323800303559c9a213c897182012536
Instruction ID: 6a874b1cc0e4f0f5b58b3ee47eb04664bda9048b30c981553c38385418640b1e
Opcode Fuzzy Hash: 6f030da9b2da43ac9bf4359c5b2a3c614323800303559c9a213c897182012536
Instruction Fuzzy Hash: B6018634500B14AFEB215B10ED8EFAA77B8BB04B46F000559B593B14E1EBF0AA848A90

Function 00BF22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF22BE

Part of subcall function 00BF29C8: HeapFree.KERNEL32(00000000,00000000,?,00BFD7D1,00000000,00000000,00000000,00000000,?,00BFD7F8,00000000,00000007,00000000,?,00BFDBF5,00000000), ref: 00BF29DE
Part of subcall function 00BF29C8: GetLastError.KERNEL32(00000000,?,00BFD7D1,00000000,00000000,00000000,00000000,?,00BFD7F8,00000000,00000007,00000000,?,00BFDBF5,00000000,00000000), ref: 00BF29F0

_free.LIBCMT ref: 00BF22D0
_free.LIBCMT ref: 00BF22E3
_free.LIBCMT ref: 00BF22F4
_free.LIBCMT ref: 00BF2305

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b991636c61370e22879c2efff82c2918f23e2ec01ec4097bf564c466c8cd4bdb
Instruction ID: c1af9c687beccf127572b73a185608ee5953626468815a41797721f7db5e54c0
Opcode Fuzzy Hash: b991636c61370e22879c2efff82c2918f23e2ec01ec4097bf564c466c8cd4bdb
Instruction Fuzzy Hash: 8CF05E718805268F8A12BF94BC46B2C3BE4FB18760715459BF914DB3B1C7700915AFE8

Function 00BD95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00BD95D4
StrokeAndFillPath.GDI32(?,?,00C171F7,00000000,?,?,?), ref: 00BD95F0
SelectObject.GDI32(?,00000000), ref: 00BD9603
DeleteObject.GDI32 ref: 00BD9616
StrokePath.GDI32(?), ref: 00BD9631

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 44bb4b3198f40ee4eb753dd13be49ccb0a34e23c19e181a957fc07258c65c216
Instruction ID: bf5a6f554b2ffd004185ba095901313a45475e2c1baefae1061da95f71e36124
Opcode Fuzzy Hash: 44bb4b3198f40ee4eb753dd13be49ccb0a34e23c19e181a957fc07258c65c216
Instruction Fuzzy Hash: 44F0873400630AEFCB224F29EC8DB6C7BA0EB503A6F088226F825651F0D7308991CF20

Function 00BF0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00BF10F9
__freea.LIBCMT ref: 00BF1117

Part of subcall function 00BF1537: _free.LIBCMT ref: 00BF154F

Strings

am/pm, xrefs: 00BF117A
a/p, xrefs: 00BF11DE

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 85f1c84442036c87a328e3c40ae9e470f8f81af824e57ca5f9618ae9949dc824
Instruction ID: 2ba4e24625f255e5b2ce8ecdad308a8d0615f30ee05e87473007468fa5c34505
Opcode Fuzzy Hash: 85f1c84442036c87a328e3c40ae9e470f8f81af824e57ca5f9618ae9949dc824
Instruction Fuzzy Hash: 60D1F33190020EEADB289F6CC895BBAB7F1EF05700F244DD9E701AB650D7359E88CB65

Function 00C47B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00BE0242: EnterCriticalSection.KERNEL32(00C9070C,00C91884,?,?,00BD198B,00C92518,?,?,?,00BC12F9,00000000), ref: 00BE024D
Part of subcall function 00BE0242: LeaveCriticalSection.KERNEL32(00C9070C,?,00BD198B,00C92518,?,?,?,00BC12F9,00000000), ref: 00BE028A

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

Part of subcall function 00BE00A3: __onexit.LIBCMT ref: 00BE00A9

__Init_thread_footer.LIBCMT ref: 00C47BFB

Part of subcall function 00BE01F8: EnterCriticalSection.KERNEL32(00C9070C,?,?,00BD8747,00C92514), ref: 00BE0202
Part of subcall function 00BE01F8: LeaveCriticalSection.KERNEL32(00C9070C,?,00BD8747,00C92514), ref: 00BE0235

Strings

Variable must be of type 'Object'., xrefs: 00C47C3A
G, xrefs: 00C47C7F
5, xrefs: 00C47C78

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 0dc165f4950e7ea294b22671f96ab565ecffff71352342a8c283fdbe535497f1
Instruction ID: 46706626d5a1701b683fd125ac57d4dbf380a49dcf11175ac3269435a1052f1f
Opcode Fuzzy Hash: 0dc165f4950e7ea294b22671f96ab565ecffff71352342a8c283fdbe535497f1
Instruction Fuzzy Hash: 02918A74A04209EFCB14EF94D885EADB7B1FF48304F108199F816AB292DB71AE85DB51

Function 00BF172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 00BF1769
_free.LIBCMT ref: 00BF1834
_free.LIBCMT ref: 00BF183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00BF1760, 00BF1767, 00BF1796, 00BF17CE

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-1639720508
Opcode ID: 27f0f6b0e3d02755e7edd125ada40d3df1a6fb36529d4defaeff003ae6038aad
Instruction ID: 2058e15ce01092cbde1597130c0cd73a83a92492b82a3980c7ccc3e2a7bc02c5
Opcode Fuzzy Hash: 27f0f6b0e3d02755e7edd125ada40d3df1a6fb36529d4defaeff003ae6038aad
Instruction Fuzzy Hash: AC318271A0021DEFDB21EB9D9985EAEBBFCEB85350F1449E6FA0497211D7704E48CB90

Function 00C2C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00C2C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00C2C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00C91990,019355A0), ref: 00C2C395

Strings

0, xrefs: 00C2C2DF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: f42c1154c2ad3e30ec802dac39a39eee6172274f5fcdfe83fcf8e79ec88b00f4
Instruction ID: 3a665dec7d9855a6170b0e7fed2ca807c258ba273bcaba7d37092f138f2be142
Opcode Fuzzy Hash: f42c1154c2ad3e30ec802dac39a39eee6172274f5fcdfe83fcf8e79ec88b00f4
Instruction Fuzzy Hash: 7041BF312043519FD720DF25E8C4B9EBBE8AF85320F008A5DF8A5972E1D770EA04DB52

Function 00C54416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00C5CC08,00000000,?,?,?,?), ref: 00C544AA
GetWindowLongW.USER32 ref: 00C544C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C544D7

Strings

SysTreeView32, xrefs: 00C5447C

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 08eb7d403d6235333e39f868d3d015f9cf12d46ffce885adebb5271e6bb0f51f
Instruction ID: 4c8392a78f381c0b47454712727c163db32e95723f50afa84356f03e67625e13
Opcode Fuzzy Hash: 08eb7d403d6235333e39f868d3d015f9cf12d46ffce885adebb5271e6bb0f51f
Instruction Fuzzy Hash: FD319C35240205AFDF248E38DC85BEA77A9EB08329F204325FD79A21D0E770EDD49754

Function 00C4304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00C43077,?,?), ref: 00C43378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00C4307A
_wcslen.LIBCMT ref: 00C4309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00C43106

Strings

255.255.255.255, xrefs: 00C43095, 00C4309A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 1a45e9ddb09e95279de5872ab97142460498ee8cf1b0f85339f0365cff06c6d9
Instruction ID: 3743534111ea7194abe88c4d97fc2e895fbd2e275ead074cd4122917ffb8e280
Opcode Fuzzy Hash: 1a45e9ddb09e95279de5872ab97142460498ee8cf1b0f85339f0365cff06c6d9
Instruction Fuzzy Hash: D631C1392002819FDB10CF69C585FAA77E0FF94318F248199E9259B392DB72EF41C760

Function 00C53EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00C53F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00C53F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C53F78

Strings

SysMonthCal32, xrefs: 00C53F0B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: be4e5b3ca85cd3eb73ceb142c87032f216f3ee9aa65669f7e1b9d614d546ac08
Instruction ID: 877b237b776df39c605b7472689d1628f5f5d707d8db64125c09af1cae657dbb
Opcode Fuzzy Hash: be4e5b3ca85cd3eb73ceb142c87032f216f3ee9aa65669f7e1b9d614d546ac08
Instruction Fuzzy Hash: 5521CC36600219BFDF118E90CC86FEE3BB5EB48754F110254FE157B1C0D6B1A9949BA0

Function 00C54653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00C54705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00C54713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00C5471A

Strings

msctls_updown32, xrefs: 00C54684

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 4f4ee7d79387e3dfd7c9533fdcf336012ffbfe22220fc6bd5c83f519cba6d8fc
Instruction ID: e39586ae9bc5559aa38b045d25a5e3966daa94c1048568b71eb49a266003e1e7
Opcode Fuzzy Hash: 4f4ee7d79387e3dfd7c9533fdcf336012ffbfe22220fc6bd5c83f519cba6d8fc
Instruction Fuzzy Hash: 142190B9600209AFDB14DF64DCC5EAB37EDEB4A3A9B040059FA109B251CB30ED95CB64

Function 00C295AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C2961D

Strings

#OnAutoItStartRegister, xrefs: 00C295F3
#requireadmin, xrefs: 00C295D9
#notrayicon, xrefs: 00C295B7

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: bef3a5b0ebe9b7d95f4e38b01f5f1c3f8f9efa3cd5bb79e48a474cb8ce9bab79
Instruction ID: 835f0fc99039d10b2a33f959162089739f09b116f58ff62ba5ece7d35c540840
Opcode Fuzzy Hash: bef3a5b0ebe9b7d95f4e38b01f5f1c3f8f9efa3cd5bb79e48a474cb8ce9bab79
Instruction Fuzzy Hash: 4E215732204631A7D331AB25EC02FBB73D8DF91300F10403AF95A97981EB71AE86C2E5

Function 00C537B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00C53840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00C53850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00C53876

Strings

Listbox, xrefs: 00C5380F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 1e18ac05333d2fce8eba0545741670fb135149256d8daf6a3f789cd601a33218
Instruction ID: 3459e983d0321be7627ad49671f43203a7ccb8b1869d38c1b585edbd6648c7c9
Opcode Fuzzy Hash: 1e18ac05333d2fce8eba0545741670fb135149256d8daf6a3f789cd601a33218
Instruction Fuzzy Hash: 5121D076600218BBEB118F64CC85FAB376AEF89791F108125F910AB190C671DD968BA4

Function 00C2223F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C22258

Part of subcall function 00BC6B57: _wcslen.LIBCMT ref: 00BC6B6A

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C2228A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C222CA

Strings

@U=u, xrefs: 00C22258, 00C2228A, 00C222CA

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID: @U=u
API String ID: 763830540-2594219639
Opcode ID: 2f025f637f3334e7e3ef1eadd0966c31f799258d7e482a38c76262b41e770f69
Instruction ID: ca5ef7595b07bdb4dd3bf1146b66a331d501baa2cd74ae5c419eb8a2ba84175d
Opcode Fuzzy Hash: 2f025f637f3334e7e3ef1eadd0966c31f799258d7e482a38c76262b41e770f69
Instruction Fuzzy Hash: A721D731700314BBDB20DB55AD8AFEE7BECEB58710F044024FA05E7190DB758E4597A1

Function 00C349F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C34A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00C34A5C
SetErrorMode.KERNEL32(00000000,?,?,00C5CC08), ref: 00C34AD0

Strings

%lu, xrefs: 00C34A6F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: c6a06b57469f0e1edf5a20261a24c920c7d64acccf4ea745c34a0ec7b0b67879
Instruction ID: 085934f1a4b3da5e698c4c99bae3b20dddcb56442f0639fc8eecb505e44791cb
Opcode Fuzzy Hash: c6a06b57469f0e1edf5a20261a24c920c7d64acccf4ea745c34a0ec7b0b67879
Instruction Fuzzy Hash: F3311075A00209AFD714DF54C985EAE7BF8EF04308F1440A9F905DB252D771EE45DB61

Function 00C21B2C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00C21B4F
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00C21B61
SendMessageW.USER32(?,0000000D,?,00000000), ref: 00C21B99

Strings

@U=u, xrefs: 00C21B99

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 7d8690117cb69f1f7fa575b54f421d2cc8fb5b217a2c5045350275c7f4800548
Instruction ID: 6b69727206afe0ff7eb8461734a7ba31d1144417931a1b50b20c424b8af2da8b
Opcode Fuzzy Hash: 7d8690117cb69f1f7fa575b54f421d2cc8fb5b217a2c5045350275c7f4800548
Instruction Fuzzy Hash: 1B21C372600218BFDB11DB98D845EAEB7F9EF54340F1404AAE505E3290EA71AF408B94

Function 00C40CD5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000402,00000000,00000000), ref: 00C40D24
SendMessageW.USER32(0000000C,00000000,?), ref: 00C40D65
SendMessageW.USER32(0000000C,00000000,?), ref: 00C40D8D

Strings

@U=u, xrefs: 00C40D24, 00C40D65, 00C40D8D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 03ee93068e21a43a0a944fd42518945c80fd7b03cdf4b720a1f2cf11b8322ff3
Instruction ID: 1f784cbf53cdd340c70d78e827110ea7e4d5cb7dccab1a2a0c114a3e7b8e509e
Opcode Fuzzy Hash: 03ee93068e21a43a0a944fd42518945c80fd7b03cdf4b720a1f2cf11b8322ff3
Instruction Fuzzy Hash: 35214435600A01AFD710EB64D996F2EB7E6FF19710B108499FA199B671CB30FC50CB90

Function 00C541EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00C5424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00C54264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00C54271

Strings

msctls_trackbar32, xrefs: 00C54226

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: bf9050e171a7c776a794876c8238aa8f650f2f4b86877e3e8bd22c65fe4cb2eb
Instruction ID: 604534c43b7a2580fc37ccae9eb784e5078a98ae479c8d019112f456d4b4acbc
Opcode Fuzzy Hash: bf9050e171a7c776a794876c8238aa8f650f2f4b86877e3e8bd22c65fe4cb2eb
Instruction Fuzzy Hash: 83110235240308BEEF205F29CC46FAB3BACEF85B69F110124FE55E20A0D671DC919B28

Function 00C22F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC6B57: _wcslen.LIBCMT ref: 00BC6B6A

Part of subcall function 00C22DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C22DC5
Part of subcall function 00C22DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C22DD6
Part of subcall function 00C22DA7: GetCurrentThreadId.KERNEL32 ref: 00C22DDD
Part of subcall function 00C22DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00C22DE4

GetFocus.USER32 ref: 00C22F78

Part of subcall function 00C22DEE: GetParent.USER32(00000000), ref: 00C22DF9

GetClassNameW.USER32(?,?,00000100), ref: 00C22FC3
EnumChildWindows.USER32(?,00C2303B), ref: 00C22FEB

Strings

%s%d, xrefs: 00C22FFF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: e7a8018621f56d7fb9b5a4a7caf316e2a4919ffec02493042eefd63a282eb246
Instruction ID: a184c9c38d04b2902a8830557d03abb627f07c29caefc359c5304d91435bbb95
Opcode Fuzzy Hash: e7a8018621f56d7fb9b5a4a7caf316e2a4919ffec02493042eefd63a282eb246
Instruction Fuzzy Hash: 6411AF756002156BDF14BF70ACD6FEE37AAAF84304F044079B909AB292DE749A49DB70

Function 00C53429 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00C534AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00C534BA

Strings

edit, xrefs: 00C5348F
@U=u, xrefs: 00C534BA

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: @U=u$edit
API String ID: 2978978980-590756393
Opcode ID: 030add6d6a84bb83f01a77a2e3e8f6d7b8e3b94f8748fa31568b8a647a3b119b
Instruction ID: 79666111e106996a275c6e28f938bb8b4c1cecea7fc90f82c58a468fbb21a588
Opcode Fuzzy Hash: 030add6d6a84bb83f01a77a2e3e8f6d7b8e3b94f8748fa31568b8a647a3b119b
Instruction Fuzzy Hash: CC119D79100248AFEB124E64DC84BAB3B6AEB043B5F504724FD71A31D0C731DED99B58

Function 00C21CDE Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

Part of subcall function 00C23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C23CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00C21D4C

Strings

ComboBox, xrefs: 00C21CEB
ListBox, xrefs: 00C21D16
@U=u, xrefs: 00C21D4C

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: @U=u$ComboBox$ListBox
API String ID: 624084870-2258501812
Opcode ID: 9479b93245b877e5049d9df608e861ab4c6d97a0877217144e93dc80452a96dd
Instruction ID: d3b8064b74106471b94c96c98dd84cd90517061c97ffca88c965028c127272e6
Opcode Fuzzy Hash: 9479b93245b877e5049d9df608e861ab4c6d97a0877217144e93dc80452a96dd
Instruction Fuzzy Hash: 4501D875601224EBDB05EFA4EC55EFE77A8EB66390F04061DFC32676C1EA7059088760

Function 00C21BD8 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

Part of subcall function 00C23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C23CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00C21C46

Strings

ComboBox, xrefs: 00C21BE5
ListBox, xrefs: 00C21C10
@U=u, xrefs: 00C21C46

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: @U=u$ComboBox$ListBox
API String ID: 624084870-2258501812
Opcode ID: 9a2dd741f3d806543b211812a4339e3f8ba90112641d27421880978c5ff2846b
Instruction ID: 1ac6251a0c71a4ca762083a52c7050eafea710cb69324879971c94f8da8ee565
Opcode Fuzzy Hash: 9a2dd741f3d806543b211812a4339e3f8ba90112641d27421880978c5ff2846b
Instruction Fuzzy Hash: AE01F7796801186BDB04FB90D955EFF77E89B21380F140029B81673681EA209F0887B5

Function 00C21C5C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

Part of subcall function 00C23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C23CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00C21CC8

Strings

ComboBox, xrefs: 00C21C69
ListBox, xrefs: 00C21C94
@U=u, xrefs: 00C21CC8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: @U=u$ComboBox$ListBox
API String ID: 624084870-2258501812
Opcode ID: 12a6abf4476b42c9059063d1b9ac519e19ff247f0dd203cd6df74ef71945fb2d
Instruction ID: fc0d5d8cec03c846ac99d8a681f0c2d0fff99f6982cb2bc4c936191c60f80829
Opcode Fuzzy Hash: 12a6abf4476b42c9059063d1b9ac519e19ff247f0dd203cd6df74ef71945fb2d
Instruction Fuzzy Hash: 9E01D67968022867DB04FBA4DA15FFF77E89B21380F180029BC1273681EA609F18D6B5

Function 00C55882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00C558C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00C558EE
DrawMenuBar.USER32(?), ref: 00C558FD

Strings

0, xrefs: 00C5588F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: aeb4e7eeabe1266a64ece860abd29604404dc383962307b0807b4c44801a76ed
Instruction ID: 87dfb916ce96d592bf8235568989917ff7a1d0826c84ee0ff378fed61824bba3
Opcode Fuzzy Hash: aeb4e7eeabe1266a64ece860abd29604404dc383962307b0807b4c44801a76ed
Instruction Fuzzy Hash: 2601C435500208EFDB109F51DC44BAEBBB4FF45362F008099E849D6261EB308AC4EF24

Function 00C21D68 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

Part of subcall function 00C23CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00C23CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00C21DD3

Strings

ComboBox, xrefs: 00C21D75
ListBox, xrefs: 00C21DA0
@U=u, xrefs: 00C21DD3

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: @U=u$ComboBox$ListBox
API String ID: 624084870-2258501812
Opcode ID: 5e2b5da77483bf512866cd66ff7c8174a15ae3ed5871ce5d6434916764f4e13a
Instruction ID: 3cf635e714bca1ec0da22af7d8fa7044f67bf5c4d1b80719334c02c4b29c0d44
Opcode Fuzzy Hash: 5e2b5da77483bf512866cd66ff7c8174a15ae3ed5871ce5d6434916764f4e13a
Instruction Fuzzy Hash: 7DF0C875B51328A7DB15FBA4DC56FFF77B8EB11390F080969B832636C1DA705A088274

Function 00C57803 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,00C918B0,00C5A364,000000FC,?,00000000,00000000,?,?,?,00C176CF,?,?,?,?,?), ref: 00C57805
GetFocus.USER32 ref: 00C5780D

Part of subcall function 00BD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BD9BB2

Part of subcall function 00BD9944: GetWindowLongW.USER32(?,000000EB), ref: 00BD9952

SendMessageW.USER32(?,000000B0,000001BC,000001C0), ref: 00C5787A

Strings

@U=u, xrefs: 00C5787A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$Long$FocusForegroundMessageSend
String ID: @U=u
API String ID: 3601265619-2594219639
Opcode ID: 0389c55c2c0444ea2f16254816a95e6bbf0c8bdc11649b941a54f15043c837ab
Instruction ID: 205ff45815b406aed9e27482596d1a960bb4afdea22e3d64fd6e2b5fb3cafba9
Opcode Fuzzy Hash: 0389c55c2c0444ea2f16254816a95e6bbf0c8bdc11649b941a54f15043c837ab
Instruction Fuzzy Hash: 3C0188355052008FC715DB28E85DB7637E5EF89321F19076DE825972E0DB316D86CB44

Function 00C23D48 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C23D03: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C23D18

SendMessageW.USER32(?,0000000C,00000000,?), ref: 00C23D64
GetParent.USER32 ref: 00C23D7A
InvalidateRect.USER32(00000000,?,00000000,00000001,?,0000000C,00000000,?), ref: 00C23D81

Strings

@U=u, xrefs: 00C23D64

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$InvalidateParentRectTimeout
String ID: @U=u
API String ID: 3648793173-2594219639
Opcode ID: e27eeb1e112edb34ae44c33b6ad3b24c79a463c350416ba7be20446f1de06073
Instruction ID: 38cfe8a2ba4a9aca917e4e707bf149dcd4aaa9b4416e30ab8fc0a27278110ada
Opcode Fuzzy Hash: e27eeb1e112edb34ae44c33b6ad3b24c79a463c350416ba7be20446f1de06073
Instruction Fuzzy Hash: F5F0E534210350FBEF206F50EC85F953B989F01741F004019F981A70A0CA66AA51DB50

Function 00C2007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f32fa1d6e0388cffba2e85ab445bf5a7bf75a1eaaa9a331e7ce9e36cbd62e7f2
Instruction ID: 66f1aa684e3de2d391f733d46c39f155561287039b73f84d6b19b14d55cb21bc
Opcode Fuzzy Hash: f32fa1d6e0388cffba2e85ab445bf5a7bf75a1eaaa9a331e7ce9e36cbd62e7f2
Instruction Fuzzy Hash: 0DC15D75A00216EFDB14CF94D898BAEB7B5FF48304F20859AE515EB262D731DE81CB90

Function 00BF3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BF3F0B
__alldvrm.LIBCMT ref: 00BF410C
__alldvrm.LIBCMT ref: 00BF412E

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: e0e9ae62fc6e209343af1319f8a47bc9a7366a39d2e68137ac8bebd7e551a3d5
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: F0A1057190038A9FDB258F28C8917BBBFE5EF65350F1841EDE6959B281C7348A89C750

Function 00C4342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C43459
CoUninitialize.OLE32 ref: 00C43463
VariantInit.OLEAUT32(?), ref: 00C4346E
VariantClear.OLEAUT32(?), ref: 00C4371B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: ef618ebe7273d8d145935a97903a0b1e1aec9e65063eb0cd461c9150b6e2acac
Instruction ID: 3e8254a852b034601621c8ae13d1def2b92159601e9f6f334864e1cbe1f5806f
Opcode Fuzzy Hash: ef618ebe7273d8d145935a97903a0b1e1aec9e65063eb0cd461c9150b6e2acac
Instruction Fuzzy Hash: E1A114756142019FCB00DF28C595E2AB7E5FF88714F05889DF98A9B362DB30EE01CB92

Function 00C20436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00C5FC08,?), ref: 00C205F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00C5FC08,?), ref: 00C20608
CLSIDFromProgID.OLE32(?,?,00000000,00C5CC40,000000FF,?,00000000,00000800,00000000,?,00C5FC08,?), ref: 00C2062D
_memcmp.LIBVCRUNTIME ref: 00C2064E

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: f761b306771e642620a0e8f8b571ccd4c857ba30d79841d63c8c143ad86b11e6
Instruction ID: 30e2fde01e5c39e7d1de288368980431ebae172a9c88e790d1ddba28534d1bb6
Opcode Fuzzy Hash: f761b306771e642620a0e8f8b571ccd4c857ba30d79841d63c8c143ad86b11e6
Instruction Fuzzy Hash: 7A816E71A00219EFCB04DF94C988EEEB7B9FF89305F204159F516AB251DB71AE46CB60

Function 00C01391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00C014C0

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a3bcd81f948049d37939316561a73f19951f8058dd08cc77873b9889abd9a52c
Instruction ID: 5b564aa63eb503a00889f915234709e6f368905dac127996c3c4c0210430e14d
Opcode Fuzzy Hash: a3bcd81f948049d37939316561a73f19951f8058dd08cc77873b9889abd9a52c
Instruction Fuzzy Hash: E7416C31600105ABDB216BFA8C456BEBBE4EF41730F1C4265FD28D72E1E7748945D261

Function 00C41AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00C41AFD
WSAGetLastError.WSOCK32 ref: 00C41B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00C41B8A
WSAGetLastError.WSOCK32 ref: 00C41B94

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 6749c5d8fbaf6f1c81f34409c9cd7d8bf5ac7f6401d5ebd7f1c76b1c49f4981f
Instruction ID: 65c6d6b0667966d50c71398601e4692358f92919d14c9c01a748fa5a806b3a68
Opcode Fuzzy Hash: 6749c5d8fbaf6f1c81f34409c9cd7d8bf5ac7f6401d5ebd7f1c76b1c49f4981f
Instruction Fuzzy Hash: 04415275640300AFE720AF24C886F297BE5EB44718F58849CF95A9F7D2E772DD818B90

Function 00BFB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2eea2eec9f10164691abdc5de865ae2159d98cdd0fc6926daf3e1a46d90df3
Instruction ID: 775a8197b7af379af0c3ddb83a93448d571e1c38638896f48631ad0423b7361a
Opcode Fuzzy Hash: 1a2eea2eec9f10164691abdc5de865ae2159d98cdd0fc6926daf3e1a46d90df3
Instruction Fuzzy Hash: 2B410875A00708AFD724AF38CC41FBABBE9EB84710F1045AEF651DB781D771A9058B80

Function 00C356D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00C35783
GetLastError.KERNEL32(?,00000000), ref: 00C357A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00C357CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00C357FA

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: e41865ff7810b6391032f3041407d040e151a007aa9e8460965088ee98d8f160
Instruction ID: 6ca801b6492fa45d762f641bd1d046edb2c593b2f908ad602c4e8de84d491dee
Opcode Fuzzy Hash: e41865ff7810b6391032f3041407d040e151a007aa9e8460965088ee98d8f160
Instruction Fuzzy Hash: 12412939610610DFCB11EF15C495A5EBBE2EF99320F188488E85AAB362CB30FD41DF91

Function 00BFD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00BE6D71,00000000,00000000,00BE82D9,?,00BE82D9,?,00000001,00BE6D71,8BE85006,00000001,00BE82D9,00BE82D9), ref: 00BFD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BFD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00BFD9AB
__freea.LIBCMT ref: 00BFD9B4

Part of subcall function 00BF3820: RtlAllocateHeap.NTDLL(00000000,?,00C91444,?,00BDFDF5,?,?,00BCA976,00000010,00C91440,00BC13FC,?,00BC13C6,?,00BC1129), ref: 00BF3852

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 1956fdedc6c3b301db18fbbdd448d5d6b9c8c946c4272a94ce8c29c71db99f32
Instruction ID: 441a589b8ed37fd64256da578d0f99174df20c52315af1ac6700d0acf6b191b2
Opcode Fuzzy Hash: 1956fdedc6c3b301db18fbbdd448d5d6b9c8c946c4272a94ce8c29c71db99f32
Instruction Fuzzy Hash: 8931AE72A0020AABDF259FA5DC85EBE7BE6EB40710B0542A8FD04D7150EB75CD58CBA0

Function 00C2AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,753DC0D0,?,00008000), ref: 00C2ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00C2AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00C2AC74
SendInput.USER32(00000001,?,0000001C,753DC0D0,?,00008000), ref: 00C2ACC6

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 7be9084367e6ce325061ccdfb30bd907f171d7841af5bdc94feb5676870516a1
Instruction ID: 5a4125a961498f9abee2210cf6cdb3cb4f1bcdd5474f70935903b96316bd5578
Opcode Fuzzy Hash: 7be9084367e6ce325061ccdfb30bd907f171d7841af5bdc94feb5676870516a1
Instruction Fuzzy Hash: 43313930A00728AFFF34CB65EC047FE7BA5AF85310F04431AE491525E1C3768B859752

Function 00C57674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00C5769A
GetWindowRect.USER32(?,?), ref: 00C57710
PtInRect.USER32(?,?,00C58B89), ref: 00C57720
MessageBeep.USER32(00000000), ref: 00C5778C

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 7cb33125a8a99229241587d7c44bbde231a1578d7dc3c8e71192da61eb5d1f63
Instruction ID: 3912114e446faaa79423ac5416c3180eb3c0857996cd9c1b9240b3812e287ec6
Opcode Fuzzy Hash: 7cb33125a8a99229241587d7c44bbde231a1578d7dc3c8e71192da61eb5d1f63
Instruction Fuzzy Hash: 9A4180386052159FCB02CF58E899FAD77F4FB49352F1942A9EC249B261C730AAC5CB94

Function 00C516DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00C516EB

Part of subcall function 00C23A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C23A57
Part of subcall function 00C23A3D: GetCurrentThreadId.KERNEL32 ref: 00C23A5E
Part of subcall function 00C23A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00C225B3), ref: 00C23A65

GetCaretPos.USER32(?), ref: 00C516FF
ClientToScreen.USER32(00000000,?), ref: 00C5174C
GetForegroundWindow.USER32 ref: 00C51752

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 030ac985359d103bf3ad4347f06f72c36c95dd13baa95d986ab7759bbb9c20be
Instruction ID: 9ba39d8ac68354ad5f11c0ba3ce6a35ec9cdfdbfe009ebf2211ad5b07fa18221
Opcode Fuzzy Hash: 030ac985359d103bf3ad4347f06f72c36c95dd13baa95d986ab7759bbb9c20be
Instruction Fuzzy Hash: D1312175D00249AFC700EFA9C8C5EAEBBF9EF58304B5480AEE415E7251DB359E45CBA0

Function 00C2D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C2D501
Process32FirstW.KERNEL32(00000000,?), ref: 00C2D50F
Process32NextW.KERNEL32(00000000,?), ref: 00C2D52F
CloseHandle.KERNEL32(00000000), ref: 00C2D5DC

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 28555c3e5b7f178f92c76b7a32c3b72c90083c15b89782a2af55fda47c0c2a24
Instruction ID: c789af752aa815e8ff54f0312c619141a2de58ad1b18447ec186dea817fad56e
Opcode Fuzzy Hash: 28555c3e5b7f178f92c76b7a32c3b72c90083c15b89782a2af55fda47c0c2a24
Instruction Fuzzy Hash: 34317E711083009FD300EF54D885FAFBBE8EF99354F14096DF592961A1EBB19A84CBA2

Function 00C58FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BD9BB2

GetCursorPos.USER32(?), ref: 00C59001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00C17711,?,?,?,?,?), ref: 00C59016
GetCursorPos.USER32(?), ref: 00C5905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00C17711,?,?,?), ref: 00C59094

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 94a53ab6f5ae3db5c198c48bf4b8deaf13440824f766c5ab1c066ff15cbbb176
Instruction ID: c4812247d9bed76e00493faed886d2e7ccc69a83e63e71b19a8f28d2cfd512ef
Opcode Fuzzy Hash: 94a53ab6f5ae3db5c198c48bf4b8deaf13440824f766c5ab1c066ff15cbbb176
Instruction Fuzzy Hash: 8B21EF39200118EFCB258F94CC98FEF7BB9EB89362F040496F905572A1D7319A90EB60

Function 00C2D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00C5CB68), ref: 00C2D2FB
GetLastError.KERNEL32 ref: 00C2D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C2D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00C5CB68), ref: 00C2D376

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 8bb2823175e3f7dc44cea83840c5405ce07d95218d4feaea5fa87cab38f45e63
Instruction ID: ed3c3ed56ece666057e596de064ac48bcc39963cc4faed99d92168665bbbbde0
Opcode Fuzzy Hash: 8bb2823175e3f7dc44cea83840c5405ce07d95218d4feaea5fa87cab38f45e63
Instruction Fuzzy Hash: 0521A1745083119F8300DF28D8859AE77F4EE66764F104A5DF4AAD32A1D730DE89CB93

Function 00C21571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C21014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00C2102A
Part of subcall function 00C21014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00C21036
Part of subcall function 00C21014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C21045
Part of subcall function 00C21014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00C2104C
Part of subcall function 00C21014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C21062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00C215BE
_memcmp.LIBVCRUNTIME ref: 00C215E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C21617
HeapFree.KERNEL32(00000000), ref: 00C2161E

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 9e27be6a02f7dddc02f29c6a14c2dd1f65723cc575b9d67eb33a478acffeee20
Instruction ID: d4a93d082b2f20175585d4e108d32ac15f41f0c21c984bbe5252d6072c6c6cf8
Opcode Fuzzy Hash: 9e27be6a02f7dddc02f29c6a14c2dd1f65723cc575b9d67eb33a478acffeee20
Instruction Fuzzy Hash: 17218C31E00218EFDF00DFA8D945BEEB7B8EF54355F184499E851AB241E730AA45CBA0

Function 00C52782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00C5280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C52824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C52832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00C52840

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 3ab9ac2642c703143d4548ec4915c375f50fa737d13ca3a5676a49d589efc7d5
Instruction ID: cbcf754b970f0faa3a291bc2d1f8331b3809143990a43e69c8aede977dbdc7d3
Opcode Fuzzy Hash: 3ab9ac2642c703143d4548ec4915c375f50fa737d13ca3a5676a49d589efc7d5
Instruction Fuzzy Hash: C121E03A204210AFD714DB24C885FAA7BD5EF46325F14815CF8268B2E2CB71EDC6C794

Function 00C278F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C28D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00C2790A,?,000000FF,?,00C28754,00000000,?,0000001C,?,?), ref: 00C28D8C
Part of subcall function 00C28D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00C28DB2
Part of subcall function 00C28D7D: lstrcmpiW.KERNEL32(00000000,?,00C2790A,?,000000FF,?,00C28754,00000000,?,0000001C,?,?), ref: 00C28DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00C28754,00000000,?,0000001C,?,?,00000000), ref: 00C27923
lstrcpyW.KERNEL32(00000000,?), ref: 00C27949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00C28754,00000000,?,0000001C,?,?,00000000), ref: 00C27984

Strings

cdecl, xrefs: 00C2797B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 17594a32c0dd19293d2ad860e23104d44a9fe5eb599bdba707254d725c1a19e5
Instruction ID: a3f02ef3285678922c504516aa15fcad97eb09404cabed8b2fb6860229b76de2
Opcode Fuzzy Hash: 17594a32c0dd19293d2ad860e23104d44a9fe5eb599bdba707254d725c1a19e5
Instruction Fuzzy Hash: 0B11033A200312AFCF15AF34E884E7B77A9FF85350B00412AF906CB7A4EB319941C7A1

Function 00C57CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00C57D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00C57D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00C57D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00C3B7AD,00000000), ref: 00C57D6B

Part of subcall function 00BD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BD9BB2

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: f65c65873d3dddf3eb6c6d2b11cfb62cbb05603178ee8b48636058dc39f3e127
Instruction ID: 31a7175b3d8efc561bcb06fe3883ebb8c2956f46f61d51894d2e79724713c3ea
Opcode Fuzzy Hash: f65c65873d3dddf3eb6c6d2b11cfb62cbb05603178ee8b48636058dc39f3e127
Instruction Fuzzy Hash: 8B11CD39204615AFCB108F28EC48BAA3BA5AF45362B254325FC39D72F0E7319AD4DB44

Function 00BF1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36f22cbb2697bb376b7ad7c5c1d1ffaefb9881dffdb72f23c46e2d2ac42adf9
Instruction ID: 50ecce5ab701386c24bad022bbec83f60e0ae2114bd6d5e3910195c4c003cac5
Opcode Fuzzy Hash: b36f22cbb2697bb376b7ad7c5c1d1ffaefb9881dffdb72f23c46e2d2ac42adf9
Instruction Fuzzy Hash: 57011AB6205A1ABEE61116786CC1F7B66ADDB413B8B341BB5B621A21D2DA608C485170

Function 00BD990F Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,?), ref: 00BD98D6
SetBkMode.GDI32(?,00000001), ref: 00BD98E9
GetStockObject.GDI32(00000005), ref: 00BD98F1
GetWindowLongW.USER32(?,000000EB), ref: 00BD9952

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ColorLongModeObjectStockTextWindow
String ID:
API String ID: 2960364272-0
Opcode ID: bfab9f73266ff575ebc9c91bb37b54368ef6a172ce84fed5b8e24e97ee206e4e
Instruction ID: e51a459d05f34ddc1bcf9198827bb07b87e9c1d48a82747f1d35842d121db715
Opcode Fuzzy Hash: bfab9f73266ff575ebc9c91bb37b54368ef6a172ce84fed5b8e24e97ee206e4e
Instruction Fuzzy Hash: DA1129361463508FC7128F60ECA9BEE77A4DB53762B19009FE502CB261E7360881DB50

Function 00C21A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00C21A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C21A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C21A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C21A8A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b1166b629a2b8b8d2bfc2d5f020ba20a1a427071aa4b4137db254800f3396d6f
Instruction ID: de066e916cda7ad0a9d48baf99dfb55cf6997997e5d4a095d2ba142b51bb4375
Opcode Fuzzy Hash: b1166b629a2b8b8d2bfc2d5f020ba20a1a427071aa4b4137db254800f3396d6f
Instruction Fuzzy Hash: 25112A3A901229FFEB10DBA5C985FADBB78EB18750F240091EA00B7290D6716F50EB94

Function 00C2E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C2E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00C2E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00C2E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00C2E24D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 3b06afcef53f481a22ac2d7372489a88ee881197f33532b845da13440c114b15
Instruction ID: ff8336a46f87a522069da84cf2ae94fc37c57b3ff2199d514931aa9329177688
Opcode Fuzzy Hash: 3b06afcef53f481a22ac2d7372489a88ee881197f33532b845da13440c114b15
Instruction Fuzzy Hash: CA110876904369FFC7019BA8AC49B9F7FACEB45321F144256F925F3691D2B08A4087A0

Function 00BED1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00BECFF9,00000000,00000004,00000000), ref: 00BED218
GetLastError.KERNEL32 ref: 00BED224
__dosmaperr.LIBCMT ref: 00BED22B
ResumeThread.KERNEL32(00000000), ref: 00BED249

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: e3cecb4146b5f8fb972eb699af633fa8864fe0015891df7aef5fb1192601d3dd
Instruction ID: a8fed7076eafecb54f4bccf2a99165ee15a4ef4334b11a2f6d9499d7c66b3ac5
Opcode Fuzzy Hash: e3cecb4146b5f8fb972eb699af633fa8864fe0015891df7aef5fb1192601d3dd
Instruction Fuzzy Hash: BC012636805248BFC7105BA7DC45BAE7BE9DF81331F100298FA24A20E0CBB0C841D6A1

Function 00C59EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00BD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BD9BB2

GetClientRect.USER32(?,?), ref: 00C59F31
GetCursorPos.USER32(?), ref: 00C59F3B
ScreenToClient.USER32(?,?), ref: 00C59F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00C59F7A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 2b18de0890e40ec361f85229f0969b29917d970603cf361440b224ad58b5abae
Instruction ID: 646919094e776757df8b5a44e67e6938b315aade91d78a37a6ebcaab63b73ce7
Opcode Fuzzy Hash: 2b18de0890e40ec361f85229f0969b29917d970603cf361440b224ad58b5abae
Instruction Fuzzy Hash: E511363A90021AEBDB00DFA9D889AEE77B8EB45312F400591F911E3140D730BBC5DBA9

Function 00BE3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00BE3B56

Part of subcall function 00BE3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00BE3AD2
Part of subcall function 00BE3AA3: ___AdjustPointer.LIBCMT ref: 00BE3AED

_UnwindNestedFrames.LIBCMT ref: 00BE3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00BE3B7C
CallCatchBlock.LIBVCRUNTIME ref: 00BE3BA4

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 5708325848ef201069593162217c0213b3869324d40df1cafb4c5e6d9a015c38
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 2901ED32100189BBDF125E96CC46EEB7BE9EF59B54F044094FE4856121C736D961DBA0

Function 00BF3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00BC13C6,00000000,00000000,?,00BF301A,00BC13C6,00000000,00000000,00000000,?,00BF328B,00000006,FlsSetValue), ref: 00BF30A5
GetLastError.KERNEL32(?,00BF301A,00BC13C6,00000000,00000000,00000000,?,00BF328B,00000006,FlsSetValue,00C62290,FlsSetValue,00000000,00000364,?,00BF2E46), ref: 00BF30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00BF301A,00BC13C6,00000000,00000000,00000000,?,00BF328B,00000006,FlsSetValue,00C62290,FlsSetValue,00000000), ref: 00BF30BF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 60a8c0af22119f531fa05260bdb03f6d4028bc95c6f71514ebbe84cc292d6d00
Instruction ID: 11d22b647f1804ae5b7885760dfe9343d917a9468fce2ea0e3621cc47ee07b0f
Opcode Fuzzy Hash: 60a8c0af22119f531fa05260bdb03f6d4028bc95c6f71514ebbe84cc292d6d00
Instruction Fuzzy Hash: 8201D83630132AAFC7314A799C84B7B77D8DF05FA1B140662FA05E3240CF21D945C6D0

Function 00C27464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00C2747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00C27497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00C274AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00C274CA

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 003eb81f699a6b38a6b452aea4a74e5272709bec574d773ec11c5305731c8280
Instruction ID: d17bedbb5c8ff3b40691409bcace8454129fcee1750b1d75cc13fe50efe50287
Opcode Fuzzy Hash: 003eb81f699a6b38a6b452aea4a74e5272709bec574d773ec11c5305731c8280
Instruction Fuzzy Hash: CC11C4B52053209FE7209F15EC88FA67FFCEB00B00F108669A626D6551D770E984DF51

Function 00C2B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00C2ACD3,?,00008000), ref: 00C2B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00C2ACD3,?,00008000), ref: 00C2B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00C2ACD3,?,00008000), ref: 00C2B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00C2ACD3,?,00008000), ref: 00C2B126

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 38320705c4c5ea822a1ec7ea5799aed9c2d483f37627dd787d67f8ab16650d67
Instruction ID: 772e54b7fc7d2aab1cd1fb88e2f91d0ad7c87834c9e5da457b69510cb238cb38
Opcode Fuzzy Hash: 38320705c4c5ea822a1ec7ea5799aed9c2d483f37627dd787d67f8ab16650d67
Instruction Fuzzy Hash: DF116171C01A3DDBCF00AFE5E9A87EEBB78FF09711F114085D951B2141CB305AA08B55

Function 00C22DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C22DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C22DD6
GetCurrentThreadId.KERNEL32 ref: 00C22DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00C22DE4

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: bcea1da489e271320d62aac0ab233b291102620fb620a1f98ec4c4caed1a4871
Instruction ID: 4fb9da6fc94ed311b70570bce08efd0a355f35a829b6546ddf75e239d146e804
Opcode Fuzzy Hash: bcea1da489e271320d62aac0ab233b291102620fb620a1f98ec4c4caed1a4871
Instruction Fuzzy Hash: 15E06D76101334BBD7201B72AC8DFEF3E6CEB42BA2F000015B105E10809AA48A80C6B0

Function 00C58863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00BD9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00BD9693
Part of subcall function 00BD9639: SelectObject.GDI32(?,00000000), ref: 00BD96A2
Part of subcall function 00BD9639: BeginPath.GDI32(?), ref: 00BD96B9
Part of subcall function 00BD9639: SelectObject.GDI32(?,00000000), ref: 00BD96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00C58887
LineTo.GDI32(?,?,?), ref: 00C58894
EndPath.GDI32(?), ref: 00C588A4
StrokePath.GDI32(?), ref: 00C588B2

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 327f50993453ed6a4944b188c45ea0c7f4f42a28359e4124c8bdb3d289ba205b
Instruction ID: 8f00df31a9982b082aaee35f2c40bbf311bf7476af293797e6de28b192fe4f09
Opcode Fuzzy Hash: 327f50993453ed6a4944b188c45ea0c7f4f42a28359e4124c8bdb3d289ba205b
Instruction Fuzzy Hash: F7F09A3A001319BADB122F94AC0EFCE3B59AF06312F048001FE21710E1C7755694CBA9

Function 00BD98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00BD98CC
SetTextColor.GDI32(?,?), ref: 00BD98D6
SetBkMode.GDI32(?,00000001), ref: 00BD98E9
GetStockObject.GDI32(00000005), ref: 00BD98F1

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: a928117e0c4d3a8a33f6f471c205f81f74d8d00467452ff52714ce569a8e2054
Instruction ID: 339827b81cac4a69e74bfb23fc4bd16bd08cdb3b5fb8a563e7738c7dac33cce5
Opcode Fuzzy Hash: a928117e0c4d3a8a33f6f471c205f81f74d8d00467452ff52714ce569a8e2054
Instruction Fuzzy Hash: 20E06D35244780AEEB215B78AC49BED3F61EB12336F04831AF6FA680E1C7714680AB10

Function 00C2162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00C21634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00C211D9), ref: 00C2163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00C211D9), ref: 00C21648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00C211D9), ref: 00C2164F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 4c73d434a24243310f90687ac68b59be3ec0c7788105e3e28e4ff376547aae3a
Instruction ID: 1dc96b7fd525c3c01e5d597ce537bf2f677e60421b88e0efdbcff0992d133773
Opcode Fuzzy Hash: 4c73d434a24243310f90687ac68b59be3ec0c7788105e3e28e4ff376547aae3a
Instruction Fuzzy Hash: 6AE04F75602321AFD7201FA0AD4DB8E3B68EF54B92F184808F655E9090D6244580C750

Function 00C1D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00C1D858
GetDC.USER32(00000000), ref: 00C1D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00C1D882
ReleaseDC.USER32(?), ref: 00C1D8A3

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3972192482cd6bdd28c604052bfd6661d015243e1ad13791b4ff2f95e7da01ae
Instruction ID: 75794996a9b607a841fbe4102ef4d29a1efedec09f06ad6246938812a787f523
Opcode Fuzzy Hash: 3972192482cd6bdd28c604052bfd6661d015243e1ad13791b4ff2f95e7da01ae
Instruction Fuzzy Hash: 3AE0E5B8800304DFCB419FA0D888B6DBBB1EB48312B108049F85AE7290CB384A81AF40

Function 00C1D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00C1D86C
GetDC.USER32(00000000), ref: 00C1D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00C1D882
ReleaseDC.USER32(?), ref: 00C1D8A3

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1a55bbee79dc4f6f191c62745d2493d2d80500c52204e81b94d983328d898c7b
Instruction ID: 823f7e3aec090e2116f0c8ec5c287c307ddf2432e1e852df77578ef3f4c80522
Opcode Fuzzy Hash: 1a55bbee79dc4f6f191c62745d2493d2d80500c52204e81b94d983328d898c7b
Instruction Fuzzy Hash: 35E07579900304DFCB519FA0D88876DBBB5AB48712B148449F95AE7250DB385A459F50

Function 00C34D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC7620: _wcslen.LIBCMT ref: 00BC7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00C34ED4

Strings

*, xrefs: 00C34E10
LPT, xrefs: 00C34DFB

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 12f9a71eeb5f95cab98b03d923a1438615242f77386becf47895e10b5776a571
Instruction ID: 6b8189b913f649a0ec340eee979285c417c7700b80690889b6131bd2e179b43e
Opcode Fuzzy Hash: 12f9a71eeb5f95cab98b03d923a1438615242f77386becf47895e10b5776a571
Instruction Fuzzy Hash: 42914175A102049FCB18DF98C494EA9BBF1BF49304F198099E41A9F362D735EE85CB91

Function 00BEE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00BEE30D

Strings

pow, xrefs: 00BEE2E5, 00BEE302

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 0287e224f0c58a5a6b55778e091a0ec62b31c0913d7b98103f47aa8f2e457bf1
Instruction ID: e75cb3c51b17a81293742361dd57fed875176d10a2dadb469dfdf43e86f82187
Opcode Fuzzy Hash: 0287e224f0c58a5a6b55778e091a0ec62b31c0913d7b98103f47aa8f2e457bf1
Instruction Fuzzy Hash: 4C519BA1A4C60A96CB227B15CD4177D3BE8EF00741F3449E9E1B1833E8EF30CC999A46

Function 00BDE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00BDE1B1

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: d59801db123c1ab308c885f9ca014abef53be4c830f3b0d2afb09b8d2ac6fe99
Instruction ID: 04895bdef1a0b6e48e9aee00a4750e7fce486fa83cafcba5fb2804c167590c47
Opcode Fuzzy Hash: d59801db123c1ab308c885f9ca014abef53be4c830f3b0d2afb09b8d2ac6fe99
Instruction Fuzzy Hash: 0B51F5755002469FEB15EF68C481AFABBE4EF56310F64409AEC61DB2D0E730DE82D790

Function 00BDF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00BDF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00BDF2BB

Strings

@, xrefs: 00BDF2AF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 0e3cbb9f6130471575db37ac4b99e15b263485c3fc545d6bbefa1057e4e22b1a
Instruction ID: 874c11bad7c1d28a9dd253f35c67408ad87fc4ea13663d596f4cac37bf7dd442
Opcode Fuzzy Hash: 0e3cbb9f6130471575db37ac4b99e15b263485c3fc545d6bbefa1057e4e22b1a
Instruction Fuzzy Hash: 1C5134725087449BD320AF14DC86BAFBBF8FB94300F81889DF1D9411A5EB708569CB6A

Function 00C22999 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00C229EB
SendMessageW.USER32(?,0000110A,00000001,?), ref: 00C22A8D

Part of subcall function 00C22C75: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00C22CE0

Strings

@U=u, xrefs: 00C229EB, 00C22A8D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: da24919a01aa1388c0543c17769314562a104e5fcc0117c0db1295760deb4728
Instruction ID: a7d4443aff3a807edf42396cf9e40825e8781a5fb486d475b5fe98ee654d6e42
Opcode Fuzzy Hash: da24919a01aa1388c0543c17769314562a104e5fcc0117c0db1295760deb4728
Instruction Fuzzy Hash: 5A41A130A00218BBDF25EF54D846FEE7BF9EF44754F040069F916A3691DB709A44DBA2

Function 00C45745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00C457E0
_wcslen.LIBCMT ref: 00C457EC

Strings

CALLARGARRAY, xrefs: 00C457E6, 00C457EB

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 64c539f0d6c4e187da26659ac383ad5d04e9485814e041b6b7eccb6b77213caa
Instruction ID: 37c66f5e7922bef6b1d3e6272a507fa13fdc056781ed307e198ad678eddc8c2e
Opcode Fuzzy Hash: 64c539f0d6c4e187da26659ac383ad5d04e9485814e041b6b7eccb6b77213caa
Instruction Fuzzy Hash: F641A471E002099FCB04EFA9C8819BEBBF5FF59354F104169E415A7392EB309E81CBA0

Function 00C3D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C3D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00C3D13A

Strings

|, xrefs: 00C3D10B

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 3df99efb77e1814b6a907f8408d8f1703bf321509bdda0bfc4404e9639057a80
Instruction ID: a1c228a1fcebfb3869a488b3f28fbabc4406bd75dec420e1f1bc63c0e5274c25
Opcode Fuzzy Hash: 3df99efb77e1814b6a907f8408d8f1703bf321509bdda0bfc4404e9639057a80
Instruction Fuzzy Hash: EC313B71D10209ABCF15EFA5DC85EEEBFB9FF04350F000059F825A6162E731AA56CB60

Function 00C5356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00C53621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00C5365C

Strings

static, xrefs: 00C535BC

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 316be1ea3bcb333e66b52cd967fb4f698bdad7f7650b80f2295e81c573810f68
Instruction ID: fc0d2a5979eaad6e850556b965dde54ef12d9ef572cbb3c7aa04d35d3947717a
Opcode Fuzzy Hash: 316be1ea3bcb333e66b52cd967fb4f698bdad7f7650b80f2295e81c573810f68
Instruction Fuzzy Hash: 2F31AD75100244AEDB109F28CC80FFB73A9FF88761F00961DFCA597290DA30AE85D768

Function 00C54537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00C5461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C54634

Strings

', xrefs: 00C5458E

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: b54164d138c50bedbc700a0be6f72a4b1e6d801baa7e60542d87b208cee0defd
Instruction ID: 3be0e5d8d02df089883fb75d8f4ef56c67da8f89437477f9ac9ced7e8e76577f
Opcode Fuzzy Hash: b54164d138c50bedbc700a0be6f72a4b1e6d801baa7e60542d87b208cee0defd
Instruction Fuzzy Hash: 36313B78A013099FDB18CF69C991BDA7BB5FF09305F14406AED04AB341E770AA85CF94

Function 00C2286B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 00C22884
SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00C228B6

Strings

@U=u, xrefs: 00C22884, 00C228B6

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 64fa3a93ef35a63f6afdbf86c74c8fc490a36242c53b162331ee92a651e6ccf7
Instruction ID: fdb8e3981d9e55c7f9ed079be1ac1e5ce1f80e9a42ca5edc87728011eb5b9109
Opcode Fuzzy Hash: 64fa3a93ef35a63f6afdbf86c74c8fc490a36242c53b162331ee92a651e6ccf7
Instruction Fuzzy Hash: 5321D836E00324BBCB15AF949481EBEB7F9EF88710F144159F915A7290EA749E81C7A0

Function 00C23BC4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C23D03: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C23D18

SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00C23C23
_strlen.LIBCMT ref: 00C23C2E

Strings

@U=u, xrefs: 00C23C23

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$Timeout_strlen
String ID: @U=u
API String ID: 2777139624-2594219639
Opcode ID: 975f4bd0c241c2d1d7b669645c634b55d1c192bc34d8f1740d63438b01d15308
Instruction ID: 8ce51bf939f437e7ea935f1084efe231b9293c2c2dff43c4d1ee55025cbd4c57
Opcode Fuzzy Hash: 975f4bd0c241c2d1d7b669645c634b55d1c192bc34d8f1740d63438b01d15308
Instruction Fuzzy Hash: 64112C327041652BCB28BE7CE886DBE77A88F45B40F10017DF906AB6D2DE189F4287D4

Function 00C5336F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C2ED19: GetLocalTime.KERNEL32 ref: 00C2ED2A
Part of subcall function 00C2ED19: _wcslen.LIBCMT ref: 00C2ED3B
Part of subcall function 00C2ED19: _wcslen.LIBCMT ref: 00C2ED79
Part of subcall function 00C2ED19: _wcslen.LIBCMT ref: 00C2EDAF
Part of subcall function 00C2ED19: _wcslen.LIBCMT ref: 00C2EDDF
Part of subcall function 00C2ED19: _wcslen.LIBCMT ref: 00C2EDEF
Part of subcall function 00C2ED19: _wcslen.LIBCMT ref: 00C2EE2B

SendMessageW.USER32(?,00001002,00000000,?), ref: 00C5340A

Strings

SysDateTimePick32, xrefs: 00C533C7
@U=u, xrefs: 00C5340A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$LocalMessageSendTime
String ID: @U=u$SysDateTimePick32
API String ID: 2216836867-2530228043
Opcode ID: b338f803a28298829cd0f79c7b8cff8ce41d3418f96f3cf03609369a17f353a6
Instruction ID: 115acfcadd809518f78c4859ba444a678c2a09beebb8227be38e7b954e697d37
Opcode Fuzzy Hash: b338f803a28298829cd0f79c7b8cff8ce41d3418f96f3cf03609369a17f353a6
Instruction Fuzzy Hash: 9C2133353402096FEF229E54DC82FEF33AAEB40395F200519FD50AB1E0DAB1ED859768

Function 00C2215F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C22178

Part of subcall function 00C2B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00C2B355
Part of subcall function 00C2B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00C22194,00000034,?,?,00001004,00000000,00000000), ref: 00C2B365
Part of subcall function 00C2B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00C22194,00000034,?,?,00001004,00000000,00000000), ref: 00C2B37B

Part of subcall function 00C2B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C221D0,?,?,00000034,00000800,?,00000034), ref: 00C2B42D

SendMessageW.USER32(?,00001073,00000000,?), ref: 00C221DF

Part of subcall function 00C2B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C221FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00C2B3F8

Strings

@U=u, xrefs: 00C22178, 00C221DF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Process$MemoryMessageSend$AllocOpenReadThreadVirtualWindowWrite
String ID: @U=u
API String ID: 1045663743-2594219639
Opcode ID: dceeac23f914c3c36636d25e7013f4a9b3bb15da3a2b657ad42367a5a01abd19
Instruction ID: a2c0693debd91cf1683d4411875209494d4d22c9d2a4bebd35df411f66efddd4
Opcode Fuzzy Hash: dceeac23f914c3c36636d25e7013f4a9b3bb15da3a2b657ad42367a5a01abd19
Instruction Fuzzy Hash: 8A213C31901228EBEF15EFA8EC81FDDBBB8FF09354F1041A5F558A6190EA715E44DB60

Function 00C531EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00C5327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C53287

Strings

Combobox, xrefs: 00C53249

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: fc694f6411e63eb9d35d7c3dda6891305a98e5b2c6e0bdeebf7337d093b61ea7
Instruction ID: 35e64299c9b3f9e244f5b66a3a5dc7df229d69da7808bfbc9c0d486de2f7c6e0
Opcode Fuzzy Hash: fc694f6411e63eb9d35d7c3dda6891305a98e5b2c6e0bdeebf7337d093b61ea7
Instruction Fuzzy Hash: 7E11E2753006487FEF219E54DC80FBB376AEB943A5F104128FD28A7292D6319E958764

Function 00C53710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00BC600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00BC604C
Part of subcall function 00BC600E: GetStockObject.GDI32(00000011), ref: 00BC6060
Part of subcall function 00BC600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00BC606A

GetWindowRect.USER32(00000000,?), ref: 00C5377A
GetSysColor.USER32(00000012), ref: 00C53794

Strings

static, xrefs: 00C53757

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 2e450b480c8df58650803ae66348bc6495a739658bc4b55f09d35b64fbf8669d
Instruction ID: 093768478cc474cead945fa6f61558dbe5a079a6d7812d8c3fcbfceaf66cac58
Opcode Fuzzy Hash: 2e450b480c8df58650803ae66348bc6495a739658bc4b55f09d35b64fbf8669d
Instruction Fuzzy Hash: 141159B6A10209AFDB00DFA8CC46EEE7BB8EB08345F004514FD65E2250E734E995DB50

Function 00C56181 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00C561FC
SendMessageW.USER32(?,00000194,00000000,00000000), ref: 00C56225

Strings

@U=u, xrefs: 00C561FC, 00C56225

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 928f8c249ce32ef25d0af63fda6f8209cb50850e0e7f64067ad2fc919c38f9bc
Instruction ID: 1e55e5d3c66afb057e379d98f5cd443921f27f11b8bd2d066d66c92952fcfcf7
Opcode Fuzzy Hash: 928f8c249ce32ef25d0af63fda6f8209cb50850e0e7f64067ad2fc919c38f9bc
Instruction Fuzzy Hash: C811B239240214BEEF158F68CD59FBE3BA4EB05316F804115FE26AB1D1D6B0DB84DB58

Function 00C3CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00C3CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00C3CDA6

Strings

<local>, xrefs: 00C3CD66

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 148b20dd5a62631b31a20c8782c4c2c01d64f3b3d6a239d8b835327e555f6c8a
Instruction ID: f741a432d59dc577dcd3c61adad549bbd8ac5d489d1f50f0b9824d8163171c1f
Opcode Fuzzy Hash: 148b20dd5a62631b31a20c8782c4c2c01d64f3b3d6a239d8b835327e555f6c8a
Instruction Fuzzy Hash: 5811A075225631BAD7284B668CC9FEBBEA8EB127A4F00422AF119A2080D7609950D7F0

Function 00C54F80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 00C54FCC

Strings

@U=u, xrefs: 00C54FCC, 00C55008

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: a1d2476585eb3216adee1395d89b469be99aa9bf2e6fdc899d0edbd71dab8bd2
Instruction ID: 903074e7c8e8c228ffe4b081a05fbf28dc1c7a3d51a23bd4a21ddb6bfb4ce1e6
Opcode Fuzzy Hash: a1d2476585eb3216adee1395d89b469be99aa9bf2e6fdc899d0edbd71dab8bd2
Instruction Fuzzy Hash: 1321037AA0020AEFCB15CFA8C9509EE7BB5FB4C304B000154FD06A3360C631EEA1DB94

Function 00C530D2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000401,?,00000000), ref: 00C53147

Strings

button, xrefs: 00C5311E
@U=u, xrefs: 00C53147

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: @U=u$button
API String ID: 3850602802-1762282863
Opcode ID: df13851a5ad80cd709fb04ceb3a2d2838eb0d1d1054f5cdfbbeb1483d1e2612d
Instruction ID: b56d1bd343484ed8231dda0fddf0825d14947de233d76edaa88a2ff40453f464
Opcode Fuzzy Hash: df13851a5ad80cd709fb04ceb3a2d2838eb0d1d1054f5cdfbbeb1483d1e2612d
Instruction Fuzzy Hash: 3D110436250245ABDF118F64DC41FEF3BAAFF08394F100114FE65A7190C776EAA5A754

Function 00C26C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00BC9CB3: _wcslen.LIBCMT ref: 00BC9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00C26CB6
_wcslen.LIBCMT ref: 00C26CC2

Strings

STOP, xrefs: 00C26CBC, 00C26CC1

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: d538e1fffb0f92c051cb87485c8b64f8d8d18df7e724a513626cd89782dfac89
Instruction ID: 46ee3812b12f031e9fb56cd971b0758078de0c0968d19a72f331de33a70c5172
Opcode Fuzzy Hash: d538e1fffb0f92c051cb87485c8b64f8d8d18df7e724a513626cd89782dfac89
Instruction Fuzzy Hash: C501D632A1053B8BCB20AFFDEC809BF77F5EB61714B500569E87297591EB31DA40C660

Function 00C223DB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C2B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C221D0,?,?,00000034,00000800,?,00000034), ref: 00C2B42D

SendMessageW.USER32(?,0000102B,?,00000000), ref: 00C2243B
SendMessageW.USER32(?,0000102B,?,00000000), ref: 00C2245E

Strings

@U=u, xrefs: 00C2243B, 00C2245E

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$MemoryProcessWrite
String ID: @U=u
API String ID: 1195347164-2594219639
Opcode ID: 0b1cb5d38f655d686e4ea38775e0d58bc68537d65d382237fd63c7355d0828ae
Instruction ID: 21e20379f548fc1f53257f71d5ce71bb71f04f8e9f4d284e2a6e5a3ae5245252
Opcode Fuzzy Hash: 0b1cb5d38f655d686e4ea38775e0d58bc68537d65d382237fd63c7355d0828ae
Instruction Fuzzy Hash: A701B932900228BBEB15BF68EC86FEEBB79DB14310F10456AF525B60D1DBB05E55CB60

Function 00C54366 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000133E,00000000,?), ref: 00C543AF
InvalidateRect.USER32(?,00000000,00000001,?,?), ref: 00C54408

Strings

@U=u, xrefs: 00C543AF

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: InvalidateMessageRectSend
String ID: @U=u
API String ID: 909852535-2594219639
Opcode ID: a9a07db7c19547728ad7b382c710ea97874de8ab3aa0a12795cdcae859acb97d
Instruction ID: 7c82ae80181fea9770d97f9604c4081a7cc62291ea48dae31bd4d41971312e38
Opcode Fuzzy Hash: a9a07db7c19547728ad7b382c710ea97874de8ab3aa0a12795cdcae859acb97d
Instruction Fuzzy Hash: 7411BF38500744AFE725CF24C891BEBBBE4FF05315F10851CE8AB9B291DB706A85DB50

Function 00C2250B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000406,00000000,00000000), ref: 00C22531
SendMessageW.USER32(?,0000040D,?,00000000), ref: 00C22564

Part of subcall function 00C2B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C221FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00C2B3F8

Part of subcall function 00BC6B57: _wcslen.LIBCMT ref: 00BC6B6A

Strings

@U=u, xrefs: 00C22531, 00C22564

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend$MemoryProcessRead_wcslen
String ID: @U=u
API String ID: 1083363909-2594219639
Opcode ID: 74cae641123f4ae229545547d94a65d3b8fe273f00d341327dc525a30fcefc92
Instruction ID: b65558b44da95a286c3cb31a57f148aa9469bb8f1aefbebf06d93289dcbaaf52
Opcode Fuzzy Hash: 74cae641123f4ae229545547d94a65d3b8fe273f00d341327dc525a30fcefc92
Instruction Fuzzy Hash: E4012971900228AFDB50EF94DC91EED77ACEB14344F80C0A9F649A6151EE705F89DB90

Function 00C590A1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00BD9BB2

DefDlgProcW.USER32(?,0000002B,?,?,?,?,?,?,?,00C1769C,?,?,?), ref: 00C59111

Part of subcall function 00BD9944: GetWindowLongW.USER32(?,000000EB), ref: 00BD9952

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00C590F7

Strings

@U=u, xrefs: 00C590F7

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: LongWindow$MessageProcSend
String ID: @U=u
API String ID: 982171247-2594219639
Opcode ID: 4926b4d40a52bf695d372b21dac8cab65457001461f45373e89ed7bf8b05c9ef
Instruction ID: d328836a0c4eabe90a66e058bfe6b4f14cd4b805e4ee2fdb19bf7aff01ccb266
Opcode Fuzzy Hash: 4926b4d40a52bf695d372b21dac8cab65457001461f45373e89ed7bf8b05c9ef
Instruction Fuzzy Hash: 9E012438100215EBDB219F14DC4AFAA3BB2FF85362F040099FD111B2E0CB326D85EB18

Function 00C2246C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C22480
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C22497

Part of subcall function 00C223DB: SendMessageW.USER32(?,0000102B,?,00000000), ref: 00C2243B

Strings

@U=u, xrefs: 00C22480, 00C22497

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 5ad9b262d2b6e2afd846479aabfbd6bef88adc0aa80a21b1f4a817adfcd031a9
Instruction ID: f3af9fdc1f70b74074a5abb3395e310e0673593523a9519b626feb32a2e86fb7
Opcode Fuzzy Hash: 5ad9b262d2b6e2afd846479aabfbd6bef88adc0aa80a21b1f4a817adfcd031a9
Instruction Fuzzy Hash: 4AF02734601221BEEB206B16DC0FEDFBF6DDF46761B100014B405B2161CAB05E81D7F0

Function 00C4747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00C47493
_wcslen.LIBCMT ref: 00C474B9

Strings

3, 3, 16, 1, xrefs: 00C47483

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 945027636a2e30c8e15459cf0f146c61b374e73c8cddf1d83d2aa6281cc59e94
Instruction ID: 2408e00a24e3f8a7bb359c3aba43dc6c6d506552131da6a7363c3edc48af8d5e
Opcode Fuzzy Hash: 945027636a2e30c8e15459cf0f146c61b374e73c8cddf1d83d2aa6281cc59e94
Instruction Fuzzy Hash: CDE02B46204260149231227A9CC197F5BC9EFC9750710296BF981D2267EB94CE9193F5

Function 00C22BE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C22BFA
SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 00C22C2A

Strings

@U=u, xrefs: 00C22BFA, 00C22C2A

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: d846fa4ad73c3b40f461df1c046a987a807b9ee7f1f0de5052bb9a3ced86b5d0
Instruction ID: f382370634a38be6d5973907cc7da7021acc5ecf0e5b76272de62e39a287a5fc
Opcode Fuzzy Hash: d846fa4ad73c3b40f461df1c046a987a807b9ee7f1f0de5052bb9a3ced86b5d0
Instruction Fuzzy Hash: B4F0A079340314BFFA11AB80EC86FAE7B58EB14762F000024F7056A0D0C9E25D4097A0

Function 00C22D60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C2286B: SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 00C22884
Part of subcall function 00C2286B: SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00C228B6

SendMessageW.USER32(?,0000110B,00000005,00000000), ref: 00C22D80
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00C22D90

Strings

@U=u, xrefs: 00C22D80, 00C22D90

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: e89a868f10e89edcb726fd17a490ce3371b9a946087b423f62b81bf88d1e8eae
Instruction ID: 1ddaafcc0ef93a0e1b069bf8e8afacd2c4e62c0777a86d5099337e44000137af
Opcode Fuzzy Hash: e89a868f10e89edcb726fd17a490ce3371b9a946087b423f62b81bf88d1e8eae
Instruction Fuzzy Hash: AAE0D83A3443057FF6210A61AD86FA7375CD758B52F100026F30465091DEA2CC50A520

Function 00C55829 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000133D,?,?), ref: 00C55855
InvalidateRect.USER32(?,?,00000001), ref: 00C55877

Strings

@U=u, xrefs: 00C55855

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: InvalidateMessageRectSend
String ID: @U=u
API String ID: 909852535-2594219639
Opcode ID: e02127dee8e9b92d5c43ca53d44b65ca4035928e126ddccf08935bd8610a905f
Instruction ID: a6a526bc0f9e1e29ac82e59d59eb8af6d66690a8f3c9cb33f092abd65525ecc1
Opcode Fuzzy Hash: e02127dee8e9b92d5c43ca53d44b65ca4035928e126ddccf08935bd8610a905f
Instruction Fuzzy Hash: 5CF08976604140EFD7208B65DC54FED7BF8EB45322F0441B2E95AD9051D6308BC5CB24

Function 00C20B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00C20B23

Strings

AutoIt, xrefs: 00C20B17
Error allocating memory., xrefs: 00C20B1C

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 01f8e4926b086f6241c2de797939fb1de6ca3eb9c768c03a3561da66ea3ec89c
Instruction ID: 8f4918cc38f4e096b20609efbdeb85cdb9b47eed5507f61936c4542ba2140a66
Opcode Fuzzy Hash: 01f8e4926b086f6241c2de797939fb1de6ca3eb9c768c03a3561da66ea3ec89c
Instruction Fuzzy Hash: 77E0D8352483182FD21436957C43F897BC4CF09F62F1004BBFB58655C38BD1299046AD

Function 00BE0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00BDF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00BE0D71,?,?,?,00BC100A), ref: 00BDF7CE

IsDebuggerPresent.KERNEL32(?,?,?,00BC100A), ref: 00BE0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00BC100A), ref: 00BE0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00BE0D7F

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 5e887cd842de5786c512018c8cdaf90e6dfde0938247b9c7ea98a875815e369a
Instruction ID: 707583fe927586ab441a6eec6b0ad9de7afd133ce53ade26590048d2acc42de4
Opcode Fuzzy Hash: 5e887cd842de5786c512018c8cdaf90e6dfde0938247b9c7ea98a875815e369a
Instruction Fuzzy Hash: B0E06DB82003418FD720AFB9E84975A7BE0AB00745F0089BDE882D6651DBF4E4C88BA1

Function 00C33017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00C3302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00C33044

Strings

aut, xrefs: 00C33038

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 5d677d0c5813e331cf472932ed8bb81a02e26d1d1cc53b6cf2b1949380394413
Instruction ID: 29571ed4db2a3bfbae2b1ba1160aec47a4b38181523f53646d058c3d45123c30
Opcode Fuzzy Hash: 5d677d0c5813e331cf472932ed8bb81a02e26d1d1cc53b6cf2b1949380394413
Instruction Fuzzy Hash: 99D05EB65003286BDA20A7A4AC8EFCB3A6CDB04751F0002A1B655E2091EAB49984CBD0

Function 00C1D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00C1D220

Strings

%.3d, xrefs: 00C1D22B
X64, xrefs: 00C1D2A8

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: cebe3b1f363ed7b461484e36c741dbd8ee7eb0a1f04aedd07f536fd78cf7d791
Instruction ID: e5d27b576a7849769cbe499b6422153e94316804fa0948de1cdcd02bd28f57da
Opcode Fuzzy Hash: cebe3b1f363ed7b461484e36c741dbd8ee7eb0a1f04aedd07f536fd78cf7d791
Instruction Fuzzy Hash: 4CD012A1808219E9CB5096D1CC85AF9B3BCEB1A301F6084A3F817A1140E634D9887761

Function 00C52356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C5236C
PostMessageW.USER32(00000000), ref: 00C52373

Part of subcall function 00C2E97B: Sleep.KERNELBASE ref: 00C2E9F3

Strings

Shell_TrayWnd, xrefs: 00C52365

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 68c15dbca75103dbfa0a55d83bda03f0b3369051ff4a80cd049a628d53e8c716
Instruction ID: e724a423a20d9d633a8c86ebd220305234b2b00635da643fafaa4f5223ab8912
Opcode Fuzzy Hash: 68c15dbca75103dbfa0a55d83bda03f0b3369051ff4a80cd049a628d53e8c716
Instruction Fuzzy Hash: 34D0C9763853107AE664B771AC5FFCA66149B04B15F4049167645BA1D0D9A0A8818A58

Function 00C52322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C5232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00C5233F

Part of subcall function 00C2E97B: Sleep.KERNELBASE ref: 00C2E9F3

Strings

Shell_TrayWnd, xrefs: 00C52325

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 138f77dc1dc5bfe8996c9812b5b9c655125b4456dc6c8be6fb2eaa2682988ae8
Instruction ID: e4b75161f22cc05ffdc0d58a9246917115edce54aae7b814840ad22d7419e0cd
Opcode Fuzzy Hash: 138f77dc1dc5bfe8996c9812b5b9c655125b4456dc6c8be6fb2eaa2682988ae8
Instruction Fuzzy Hash: 93D0127A394310BBE664B771EC5FFCA7A149B00B15F4049167745BB1D0D9F0A881CB54

Function 00C22313 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00C2231F
SendMessageW.USER32(00000000,00001200,00000000,00000000), ref: 00C2232D

Strings

@U=u, xrefs: 00C2231F, 00C2232D

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 8b1501d65cbd767533aec1df16e460f038ce3cb1aede97846d199079e853755f
Instruction ID: 9f31a00a97e6e51cb9ead0ef22a80fdbb8c7a67167dd065454308fa477e47c38
Opcode Fuzzy Hash: 8b1501d65cbd767533aec1df16e460f038ce3cb1aede97846d199079e853755f
Instruction Fuzzy Hash: 6FC04C351403C0BEF7311B67BD4DF5B3E3DE7DBF52710115CB215A50A58A650195D634

Function 00BFBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00BFBE93
GetLastError.KERNEL32 ref: 00BFBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BFBEFC

Memory Dump Source

Source File: 00000000.00000002.2589290252.0000000000BC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BC0000, based on PE: true

Associated: 00000000.00000002.2589263425.0000000000BC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C5C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589370311.0000000000C82000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589429219.0000000000C8C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2589450692.0000000000C94000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: c9967e84a9adf950b4f66eb9eec35b66ee362e04c5950fb079afbde1a4e0c2f5
Instruction ID: a337fa362d098e438f99d9a9268dd8085b199e82860d54e8750776f988bff9ae
Opcode Fuzzy Hash: c9967e84a9adf950b4f66eb9eec35b66ee362e04c5950fb079afbde1a4e0c2f5
Instruction Fuzzy Hash: 6A41D23560020AAFCF218F65CC84FBA7BE5EF41320F2441E9FA599B1A1DB308D09CB60

Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 23.200.0.9 23.200.0.9

Source: global traffic	HTTP traffic detected: GET /config/v1/Edge/117.0.2045.47?clientId=8269936211167973170&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=1&mngd=0&installdate=1725625075&edu=&bphint=2&soobedate=1696496377&fg=1 HTTP/1.1Host: config.edge.skype.comConnection: keep-aliveAccept-Encoding: gzipSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.228
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.14
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.41.14

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\267908a8-eaaa-4ddd-83b3-224533da0724.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\38c58245-28cf-46eb-845b-7de554eb5d4d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\40033a9e-66fc-4481-8397-96994df845b1.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4dd47970-913f-458d-a8fa-247035345a16.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\59fe68bc-9b4c-4739-9282-1bc6515f08f9.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\873917dd-c33b-4aae-9768-c89f419db94f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\93b9398b-ac87-4f40-8456-f92795dd8e7d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\e986142e-875a-4b7c-9764-a6b057fa0957.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66DAF2F3-1D7C.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66DAF2F4-1EA8.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\59948aaa-95fd-45b0-9bbd-a07c2ca6179c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\67b8302d-a5fd-4dc5-ac55-6fe9f14a705f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7e87ef44-626b-4303-a442-4d37e1beaa20.tmp

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre